The affected modules misorder byte‑string keys when performing canonical encoding. Keys that are flagged as UTF‑8 are decoded as UTF‑8 for comparison, causing Latin‑1 keys whose byte sequence is valid UTF‑8 to be sorted incorrectly. This leads to two distinct canonical documents for the same input, potentially undermining any process that relies on deterministic ordering for verification, caching, or security checks.

Perl users of Cpanel::JSON::XS versions 4.43 through 4.79 are impacted. The issue does not affect later releases, starting with 4.80. Systems that depend on canonical JSON encoding and use those versions are therefore at risk.

The vulnerability has no known public exploits and is not listed in the CISA KEV catalog. The CVSS score is 7.5, and the EPSS score is less than 1%. While the flaw does not directly grant code execution or high‑impact lateral movement, it can break consistency guarantees and expose systems to subtle integrity problems if identical documents are expected to match across processes. The likely attack vector involves an attacker providing a crafted JSON payload to a vulnerable application that performs canonical encoding, potentially causing inconsistent ordering across different processes and enabling integrity violations or denial of service.