CVE-2026-124539 · Package
NO FIX YET · SEE WHAT TO DO
JSON::XS before 4.05 for Perl does not free the decoded key when it rejects an object missing a colon after the key. A long-running process that keeps decoding untrusted input can have its memory exhausted by repeated bad documents.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Perl applications that use JSON::XS to decode JSON from untrusted sources in a long-running process, such as a web service or daemon. Short-lived scripts that exit after each decode are unlikely to accumulate enough leaked memory to matter. Teams that do not use JSON::XS, or only decode trusted local files, can skip it.
Not affected if short-lived-scripts, trusted-input-only
Who cares json-xs, long-running-services, perl
perl -MJSON::XS -e 'print $JSON::XS::VERSION'4.05 in cpanfile.snapshot, Makefile.PL or Build.PL dependency lists4.05 or laterJSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv.
Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key.
A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.