Cpanel::JSON::XS allows malformed UTF‑8 characters to be stored as bare hash keys when the allow_barekey option is used. A malformed key becomes an UTF‑8 flagged string without validation. Subsequent operations such as lc, uc, or re‑encoding the hash will raise a malformed‑UTF‑8 exception, potentially crashing the application that parsed the JSON. The vulnerability is limited to data handling and does not grant code execution, but the crash can be leveraged to deny service to users or to disrupt business logic.

The issue exists in the Cpanel::JSON::XS Perl module for versions 4.33 up to and including 4.79. Systems that load this library for parsing JSON payloads—such as web applications, CGI scripts, or REST APIs written in Perl—are affected. Updates before 4.80 have not implemented the necessary UTF‑8 validation for bare keys.

The vulnerability was not listed in the CISA Known Exploited Vulnerabilities catalog and the EPSS score of <1% indicates a very low exploitation probability under current threat activity. However, the lack of input validation means that a crafted JSON payload could be injected remotely via any HTTP endpoint that decodes user input with allow_barekey enabled. The attack would result in a runtime exception and crash, leading to a denial of service. There is no evidence of privilege escalation or code execution, and the impact is confined to the process that parsed the malformed data.