CVE-2026-124536 · Package
NO FIX YET · SEE WHAT TO DO
JSON::XS versions before 4.05 for Perl keep buffering incremental input past the max_size limit once a NUL byte appears. A peer streaming data to an incr_parse consumer can exhaust the process memory.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use JSON::XS incremental parsing (incr_parse) on input streamed from a peer or network client are exposed. Programs that parse only complete, trusted JSON strings are not on the incremental path and can skip it.
Not affected if no-incr-parse, trusted-input-only
Who cares json-xs, perl
perl -MJSON::XS -e 'print $JSON::XS::VERSION'incr_parse on data from untrusted peers4.05 or later (per the advisory's affected range: before 4.05)JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse.
The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL.
A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.