Vulnpedia
← Search CVEs

CVE-2026-110687

N/A

Published 2026-10-19 · Last modified 2026-10-19

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 6th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

CPE data not yet published (analysis pending).

Weakness (CWE)

  • CWE-176: Improper Handling of Unicode Encoding

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

  • All currently supported Red Hat products · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    Red Hat · CVE-2026-110687 · Updated 2026-10-20T18:16:07+00:00

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS