{"id":"CVE-2026-124536","kind":"vulnerability","aliases":["CVE-2026-124536"],"related":[],"title":"JSON::XS for Perl: NUL byte lets streamed input exhaust memory","description":"JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse.\n\nThe parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL.\n\nA peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.","summary":"JSON::XS versions before 4.05 for Perl keep buffering incremental input past the max_size limit once a NUL byte appears. A peer streaming data to an incr_parse consumer can exhaust the process memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["json-xs","package","perl"],"not_affected_if":["no-incr-parse","trusted-input-only"],"how_to_check":"- Check the installed JSON::XS version with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Look for code calling `incr_parse` on data from untrusted peers","fix":"- JSON::XS `4.05` or later (per the advisory's affected range: before 4.05)","status":"open","published_at":"2026-11-14T12:17:42+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","triaged_at":"2026-11-14T12:30:36+00:00","updated_at":"2026-11-14T12:30:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T12:30:36Z","model":"claude-haiku-5-5","output":{"fix":"- JSON::XS `4.05` or later (per the advisory's affected range: before 4.05)","reach":"network","title":"JSON::XS for Perl: NUL byte lets streamed input exhaust memory","impact":"low","summary":"JSON::XS versions before 4.05 for Perl keep buffering incremental input past the max_size limit once a NUL byte appears. A peer streaming data to an incr_parse consumer can exhaust the process memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","json-xs"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote peer exhausts process memory, causing denial of service","analyst_note":"Confirm the fixed version and whether incr_parse with max_size is the only trigger, using the NVD entry and the JSON::XS changelog.","how_to_check":"- Check the installed JSON::XS version with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Look for code calling `incr_parse` on data from untrusted peers\n- unknown for anything beyond this","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-incr-parse","trusted-input-only"],"who_is_affected":"Applications that use JSON::XS incremental parsing (incr_parse) on input streamed from a peer or network client are exposed. Programs that parse only complete, trusted JSON strings are not on the incremental path and can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4641,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124536':14A,17A '-2026':13A,16A '4.05':27B,62C 'allow':65C 'appear':43B 'append':84C 'buffer':31B,69C,89C,103C,132C 'byte':6A,42B,78C,109C,124C 'cannot':138C 'chunk':86C 'compar':91C 'consum':52B,150C 'cve':12A,15A 'data':47B,145C 'end':112C 'exhaust':10A,54B,67C,152C 'far':96C 'first':121C 'grow':134C 'incr':50B,80C,136C,148C 'increment':32B,70C 'input':9A,33B,71C,115C 'json':1A,19B,23B,58C 'json-x':18B 'keep':30B,125C,133C 'length':104C 'let':7A 'limit':38B,130C 'max':36B,73C,92C,122C,157C 'memori':11A,57B,66C,154C 'nul':5A,41B,77C,108C,118C,141C 'packag':21B 'pars':51B,81C,149C 'parser':83C 'past':34B,72C 'peer':45B,143C 'perl':4A,22B,29B,64C 'process':56B,153C 'progress':99C 'regardless':155C 'remov':139C 'short':127C 'size':37B,74C,93C,123C,158C 'skip':137C 'stream':8A,46B,144C 'treat':106C 'version':25B,60C 'within':119C 'xs':2A,20B,24B,59C","nicknames":[],"mitigations":[],"who_affected":"Applications that use JSON::XS incremental parsing (incr_parse) on input streamed from a peer or network client are exposed. Programs that parse only complete, trusted JSON strings are not on the incremental path and can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jsonxs","package","perl","unknown"],"campaign_type":null,"search_a":"'-124536':14A,17A '-2026':13A,16A 'byte':6A 'cve':12A,15A 'exhaust':10A 'input':9A 'json':1A 'let':7A 'memori':11A 'nul':5A 'perl':4A 'stream':8A 'xs':2A","search_b":"'4.05':27B 'appear':43B 'buffer':31B 'byte':42B 'consum':52B 'data':47B 'exhaust':54B 'incr':50B 'increment':32B 'input':33B 'json':19B,23B 'json-x':18B 'keep':30B 'limit':38B 'max':36B 'memori':57B 'nul':41B 'packag':21B 'pars':51B 'past':34B 'peer':45B 'perl':22B,29B 'process':56B 'size':37B 'stream':46B 'version':25B 'xs':20B,24B","search_c":"'4.05':62C 'allow':65C 'append':84C 'buffer':69C,89C,103C,132C 'byte':78C,109C,124C 'cannot':138C 'chunk':86C 'compar':91C 'consum':150C 'data':145C 'end':112C 'exhaust':67C,152C 'far':96C 'first':121C 'grow':134C 'incr':80C,136C,148C 'increment':70C 'input':71C,115C 'json':58C 'keep':125C,133C 'length':104C 'limit':130C 'max':73C,92C,122C,157C 'memori':66C,154C 'nul':77C,108C,118C,141C 'pars':81C,149C 'parser':83C 'past':72C 'peer':143C 'perl':64C 'process':153C 'progress':99C 'regardless':155C 'remov':139C 'short':127C 'size':74C,93C,123C,158C 'skip':137C 'stream':144C 'treat':106C 'version':60C 'within':119C 'xs':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124536","severity":null,"published_at":"2026-11-14T12:17:42+00:00","modified_at":"2026-11-14T12:17:42+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","fetched_at":"2026-11-14T12:28:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}