Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.

decode_hv() collapses duplic…

CVE-2026-9334 affects Cpanel::JSON::XS versions before 4.41 for Perl, allowing type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. The vulnerability occurs in decode_hv() function which collapses duplicate object keys into an array reference. A logical error in the branch handling duplicate keys causes SvRV(old_value) to be evaluated before confirming old_value is a reference. When the existing value is a plain scalar instead of an array reference, a non-reference scalar gets dereferenced as a reference. Attackers can exploit this by providing untrusted JSON with duplicate keys to crash applications and potentially achieve code execution through controlled scalar contents.