{"id":"CVE-2026-124540","kind":"vulnerability","aliases":["CVE-2026-124540"],"related":[],"title":"JSON::XS for Perl: nested tagged values crash the process via stack exhaustion","description":"JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.\n\nWith allow_tags, \"(\" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.\n\nA run of \"(\" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.","summary":"JSON::XS versions before 4.05 decode nested tagged values under allow_tags without counting them against max_depth. A crafted input made of repeated \"(\" bytes exhausts the C stack and causes an uncatchable segmentation fault, which takes down the process.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["json-xs","package","perl"],"not_affected_if":["allow-tags-disabled","trusted-input-only"],"how_to_check":"- Check the installed JSON::XS version with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Search dependency manifests and lockfiles for `JSON::XS` and any code calling `allow_tags` or `decode_tag`","fix":"- JSON::XS: `4.05` or later (the sources state versions before 4.05 are affected)","status":"open","published_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","triaged_at":"2026-11-14T12:30:32+00:00","updated_at":"2026-11-14T12:30:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T12:30:32Z","model":"claude-haiku-5-5","output":{"fix":"- JSON::XS: `4.05` or later (the sources state versions before 4.05 are affected)","reach":"unknown","title":"JSON::XS for Perl: nested tagged values crash the process via stack exhaustion","impact":"low","summary":"JSON::XS versions before 4.05 decode nested tagged values under allow_tags without counting them against max_depth. A crafted input made of repeated \"(\" bytes exhausts the C stack and causes an uncatchable segmentation fault, which takes down the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","json-xs"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Process crashes via segmentation fault, denying service to the application","analyst_note":"unknown","how_to_check":"- Check the installed JSON::XS version with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Search dependency manifests and lockfiles for `JSON::XS` and any code calling `allow_tags` or `decode_tag`\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["allow-tags-disabled","trusted-input-only"],"who_is_affected":"Applications written in Perl that use JSON::XS to decode untrusted JSON with the allow_tags option enabled can be crashed by a crafted input. Code that does not enable allow_tags, or that only decodes trusted data, is less exposed. The sources do not describe other configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4612,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124540':16A,19A '-2026':15A,18A '4.05':29B,69C 'allow':35B,72C,80C,86C 'anoth':103C 'array':107C 'byte':49B,121C 'c':52B,124C 'caus':55B 'count':38B,114C 'craft':44B 'crash':8A 'cve':14A,17A 'decod':30B,83C,97C 'depth':42B,117C,135C 'exhaust':13A,50B,74C,122C 'fault':59B,131C 'input':45B 'json':1A,21B,25B,65C 'json-x':20B 'made':46B 'max':41B,116C,134C 'nest':5A,31B,76C,111C 'object':109C 'packag':23B 'perl':4A,24B,71C 'process':10A,64B 'recurs':98C 'regardless':132C 'repeat':48B 'run':119C 'segment':58B,130C 'stack':12A,53B,73C,125C 'start':88C,102C 'tag':6A,32B,36B,77C,81C,84C,87C,90C,93C,104C 'take':61B 'trigger':127C 'uncatch':57B,129C 'unlik':106C 'valu':7A,33B,78C,91C,95C,105C 'version':27B,67C 'via':11A,75C 'without':37B 'xs':2A,22B,26B,66C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that use JSON::XS to decode untrusted JSON with the allow_tags option enabled can be crashed by a crafted input. Code that does not enable allow_tags, or that only decodes trusted data, is less exposed. The sources do not describe other configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jsonxs","package","perl"],"campaign_type":null,"search_a":"'-124540':16A,19A '-2026':15A,18A 'crash':8A 'cve':14A,17A 'exhaust':13A 'json':1A 'nest':5A 'perl':4A 'process':10A 'stack':12A 'tag':6A 'valu':7A 'via':11A 'xs':2A","search_b":"'4.05':29B 'allow':35B 'byte':49B 'c':52B 'caus':55B 'count':38B 'craft':44B 'decod':30B 'depth':42B 'exhaust':50B 'fault':59B 'input':45B 'json':21B,25B 'json-x':20B 'made':46B 'max':41B 'nest':31B 'packag':23B 'perl':24B 'process':64B 'repeat':48B 'segment':58B 'stack':53B 'tag':32B,36B 'take':61B 'uncatch':57B 'valu':33B 'version':27B 'without':37B 'xs':22B,26B","search_c":"'4.05':69C 'allow':72C,80C,86C 'anoth':103C 'array':107C 'byte':121C 'c':124C 'count':114C 'decod':83C,97C 'depth':117C,135C 'exhaust':74C,122C 'fault':131C 'json':65C 'max':116C,134C 'nest':76C,111C 'object':109C 'perl':71C 'recurs':98C 'regardless':132C 'run':119C 'segment':130C 'stack':73C,125C 'start':88C,102C 'tag':77C,81C,84C,87C,90C,93C,104C 'trigger':127C 'uncatch':129C 'unlik':106C 'valu':78C,91C,95C,105C 'version':67C 'via':75C 'xs':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124540","severity":null,"published_at":"2026-11-14T12:17:43+00:00","modified_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","fetched_at":"2026-11-14T12:28:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}