CVE-2026-124540 · Package
NO FIX YET · SEE WHAT TO DO
JSON::XS versions before 4.05 decode nested tagged values under allow_tags without counting them against max_depth. A crafted input made of repeated "(" bytes exhausts the C stack and causes an uncatchable segmentation fault, which takes down the process.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications written in Perl that use JSON::XS to decode untrusted JSON with the allow_tags option enabled can be crashed by a crafted input. Code that does not enable allow_tags, or that only decodes trusted data, is less exposed. The sources do not describe other configurations.
Not affected if allow-tags-disabled, trusted-input-only
Who cares json-xs, perl
perl -MJSON::XS -e 'print $JSON::XS::VERSION'JSON::XS and any code calling allow_tags or decode_tag4.05 or later (the sources state versions before 4.05 are affected)JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.
With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.
A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.