{"id":"CVE-2026-124539","kind":"vulnerability","aliases":["CVE-2026-124539"],"related":[],"title":"JSON::XS for Perl leaks memory on malformed JSON objects","description":"JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv.\n\nUnless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","summary":"JSON::XS before 4.05 for Perl does not free the decoded key when it rejects an object missing a colon after the key. A long-running process that keeps decoding untrusted input can have its memory exhausted by repeated bad documents.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["json-xs","long-running-services","package","perl"],"not_affected_if":["short-lived-scripts","trusted-input-only"],"how_to_check":"- Check the installed JSON::XS version with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Look for a JSON::XS entry below `4.05` in `cpanfile.snapshot`, `Makefile.PL` or `Build.PL` dependency lists\n- Note whether the service keeps running after failed JSON decodes and accepts JSON from untrusted clients","fix":"- JSON::XS: upgrade to `4.05` or later","status":"open","published_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","triaged_at":"2026-11-14T12:30:36+00:00","updated_at":"2026-11-14T12:30:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T12:30:36Z","model":"claude-haiku-5-5","output":{"fix":"- JSON::XS: upgrade to `4.05` or later","reach":"network","title":"JSON::XS for Perl leaks memory on malformed JSON objects","impact":"low","summary":"JSON::XS before 4.05 for Perl does not free the decoded key when it rejects an object missing a colon after the key. A long-running process that keeps decoding untrusted input can have its memory exhausted by repeated bad documents.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","json-xs","long-running-services"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"repeated malformed requests exhaust process memory, causing denial of service","analyst_note":"","how_to_check":"- Check the installed JSON::XS version with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Look for a JSON::XS entry below `4.05` in `cpanfile.snapshot`, `Makefile.PL` or `Build.PL` dependency lists\n- Note whether the service keeps running after failed JSON decodes and accepts JSON from untrusted clients","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["short-lived-scripts","trusted-input-only"],"who_is_affected":"Perl applications that use JSON::XS to decode JSON from untrusted sources in a long-running process, such as a web service or daemon. Short-lived scripts that exit after each decode are unlikely to accumulate enough leaked memory to matter. Teams that do not use JSON::XS, or only decode trusted local files, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000758,"input_tokens":4602,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124539':13A,16A '-2026':12A,15A '4.05':29B,72C 'ascii':95C 'bad':66B 'chosen':138C 'colon':45B,86C 'cve':11A,14A 'decod':36B,56B,77C,88C,100C,128C 'document':67B,134C 'exhaust':63B,144C 'fail':127C 'free':34B,106C 'hv':89C 'input':58B 'json':1A,9A,18B,26B,68C 'json-x':17B 'keep':55B,123C 'key':37B,48B,78C,98C,119C,131C 'leak':5A,75C 'long':21B,51B 'long-run':50B 'long-running-servic':20B 'malform':8A 'memori':6A,62B,146C 'miss':43B,85C,116C 'new':103C 'noth':105C 'object':10A,42B,81C,111C 'one':130C 'packag':24B 'per':132C 'perl':4A,25B,31B,74C 'plain':94C 'process':53B,121C,145C 'quot':97C 'reject':40B,82C,113C,133C 'repeat':65B,142C 'request':143C 'retain':129C 'run':22B,52B,124C 'scalar':104C,108C 'sender':141C 'servic':23B 'short':93C 'size':137C 'unless':90C 'untrust':57B 'version':70C 'xs':2A,19B,27B,69C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that use JSON::XS to decode JSON from untrusted sources in a long-running process, such as a web service or daemon. Short-lived scripts that exit after each decode are unlikely to accumulate enough leaked memory to matter. Teams that do not use JSON::XS, or only decode trusted local files, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jsonxs","longrunningservices","package","perl","unknown"],"campaign_type":null,"search_a":"'-124539':13A,16A '-2026':12A,15A 'cve':11A,14A 'json':1A,9A 'leak':5A 'malform':8A 'memori':6A 'object':10A 'perl':4A 'xs':2A","search_b":"'4.05':29B 'bad':66B 'colon':45B 'decod':36B,56B 'document':67B 'exhaust':63B 'free':34B 'input':58B 'json':18B,26B 'json-x':17B 'keep':55B 'key':37B,48B 'long':21B,51B 'long-run':50B 'long-running-servic':20B 'memori':62B 'miss':43B 'object':42B 'packag':24B 'perl':25B,31B 'process':53B 'reject':40B 'repeat':65B 'run':22B,52B 'servic':23B 'untrust':57B 'xs':19B,27B","search_c":"'4.05':72C 'ascii':95C 'chosen':138C 'colon':86C 'decod':77C,88C,100C,128C 'document':134C 'exhaust':144C 'fail':127C 'free':106C 'hv':89C 'json':68C 'keep':123C 'key':78C,98C,119C,131C 'leak':75C 'memori':146C 'miss':85C,116C 'new':103C 'noth':105C 'object':81C,111C 'one':130C 'per':132C 'perl':74C 'plain':94C 'process':121C,145C 'quot':97C 'reject':82C,113C,133C 'repeat':142C 'request':143C 'retain':129C 'run':124C 'scalar':104C,108C 'sender':141C 'short':93C 'size':137C 'unless':90C 'version':70C 'xs':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124539","severity":null,"published_at":"2026-11-14T12:17:43+00:00","modified_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","fetched_at":"2026-11-14T12:28:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}