The vulnerability is a type‑confusion flaw in Cpanel::JSON::XS versions 4.33 through 4.79 for Perl. Duplicate, non‑ASCII bare keys are mishandled in decode_hv when allow_barekey and dupkeys_as_arrayref options are enabled, causing a duplicate key to bypass the duplicate‑key check and overwrite earlier values. Subsequent processing can then treat a numeric key as a pointer, potentially dereferencing an attacker‑controlled address or causing a process crash. This flaw directly compromises integrity and availability of the application.

Perl applications that depend on Cpanel::JSON::XS and enable allow_barekey with dupkeys_as_arrayref, including many web hosting control panels and custom services that accept external JSON payloads. The affected library versions range from 4.33 up to but not including 4.80; patching to 4.80 or later resolves the issue.

The CVSS score is 6.5 and EPSS is < 1%, but the lack of a KEV listing does not lessen the potential impact. An attacker who can supply untrusted JSON to the vulnerable code is likely able to trigger a crash or, under the best‑case scenario, coerce the program into dereferencing a chosen address. Because the flaw is triggered by external input, the attack vector is likely remote. The risk is high, especially in environments where untrusted data is processed without strict sanitisation.