CVE-2026-124541 · Package
NO FIX YET · SEE WHAT TO DO
JSON::XS for Perl versions before 4.05 keep the decoded part of a long string after the decoder rejects it, because a temporary scalar is never freed. A long-running process that keeps parsing bad input can have its memory exhausted by repeated requests.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Perl applications that use JSON::XS to decode JSON from untrusted sources inside a process that keeps running between requests, such as web services or daemons. Short scripts that exit after each decode are not exposed in practice, and processes that only decode trusted local files can skip it.
Not affected if short-lived-scripts, trusted-input-only
Who cares json-xs, perl, self-hosted
perl -MJSON::XS -e 'print $JSON::XS::VERSION'JSON::XS in cpanfile, Makefile.PL or META.json of each deployed Perl applicationdecode_json or JSON::XS->new->decode in a long-running processJSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str.
A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input.
A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.