{"id":"CVE-2026-124541","kind":"vulnerability","aliases":["CVE-2026-124541"],"related":[],"title":"Perl JSON::XS: rejected long strings leak memory on each failed decode","description":"JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str.\n\nA string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input.\n\nA process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.","summary":"JSON::XS for Perl versions before 4.05 keep the decoded part of a long string after the decoder rejects it, because a temporary scalar is never freed. A long-running process that keeps parsing bad input can have its memory exhausted by repeated requests.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["json-xs","package","perl","self-hosted"],"not_affected_if":["short-lived-scripts","trusted-input-only"],"how_to_check":"- Find JSON::XS in the Perl dependencies, for example with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Check for `JSON::XS` in `cpanfile`, `Makefile.PL` or `META.json` of each deployed Perl application\n- Confirm whether the service decodes untrusted JSON with `decode_json` or `JSON::XS->new->decode` in a long-running process","fix":"- JSON::XS: move to version 4.05 or later (the sources say versions before 4.05 are affected)","status":"open","published_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","triaged_at":"2026-11-14T12:30:32+00:00","updated_at":"2026-11-14T12:30:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T12:30:32Z","model":"claude-haiku-5-5","output":{"fix":"- JSON::XS: move to version 4.05 or later (the sources say versions before 4.05 are affected)","reach":"network","title":"Perl JSON::XS: rejected long strings leak memory on each failed decode","impact":"medium","summary":"JSON::XS for Perl versions before 4.05 keep the decoded part of a long string after the decoder rejects it, because a temporary scalar is never freed. A long-running process that keeps parsing bad input can have its memory exhausted by repeated requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","json-xs","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Repeated requests exhaust process memory, causing a denial of service","analyst_note":"","how_to_check":"- Find JSON::XS in the Perl dependencies, for example with `perl -MJSON::XS -e 'print $JSON::XS::VERSION'`\n- Check for `JSON::XS` in `cpanfile`, `Makefile.PL` or `META.json` of each deployed Perl application\n- Confirm whether the service decodes untrusted JSON with `decode_json` or `JSON::XS->new->decode` in a long-running process","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["short-lived-scripts","trusted-input-only"],"who_is_affected":"Perl applications that use JSON::XS to decode JSON from untrusted sources inside a process that keeps running between requests, such as web services or daemons. Short scripts that exit after each decode are not exposed in practice, and processes that only decode trusted local files can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000768,"input_tokens":4631,"output_tokens":609,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124541':15A,18A '-2026':14A,17A '-8':137C '16':101C '4.04':104C '4.05':33B,76C 'bad':62B 'buffer':100C,109C 'charact':131C 'chosen':164C 'content':112C 'control':130C 'cve':13A,16A 'decod':12A,36B,44B,81C,89C,94C,152C,155C 'end':140C 'escap':134C 'exhaust':68B,170C 'fail':11A,151C 'fill':110C 'fix':98C 'fixed-s':97C 'free':119C 'freed':53B 'host':26B 'input':63B,143C 'invalid':133C 'json':2A,20B,27B,72C 'json-x':19B 'keep':34B,60B,147C 'kib':102C 'leak':7A,79C 'long':5A,40B,56B,86C 'long-run':55B 'malform':135C 'memori':8A,67B,172C 'move':113C 'never':52B 'new':116C 'noth':118C 'packag':22B 'pars':61B 'part':37B,82C,156C 'perl':1A,23B,30B,78C 'process':58B,145C,171C 'reject':4A,45B,85C,127C,159C 'repeat':70B,168C 'request':71B,169C 'retain':153C 'run':57B,148C 'scalar':50B,117C,121C 'self':25B 'self-host':24B 'sender':167C 'size':99C,163C 'str':90C 'string':6A,41B,87C,92C,124C,160C 'temporari':49B 'time':107C 'utf':136C 'version':31B,74C 'xs':3A,21B,28B,73C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that use JSON::XS to decode JSON from untrusted sources inside a process that keeps running between requests, such as web services or daemons. Short scripts that exit after each decode are not exposed in practice, and processes that only decode trusted local files can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jsonxs","medium","package","perl","selfhosted"],"campaign_type":null,"search_a":"'-124541':15A,18A '-2026':14A,17A 'cve':13A,16A 'decod':12A 'fail':11A 'json':2A 'leak':7A 'long':5A 'memori':8A 'perl':1A 'reject':4A 'string':6A 'xs':3A","search_b":"'4.05':33B 'bad':62B 'decod':36B,44B 'exhaust':68B 'freed':53B 'host':26B 'input':63B 'json':20B,27B 'json-x':19B 'keep':34B,60B 'long':40B,56B 'long-run':55B 'memori':67B 'never':52B 'packag':22B 'pars':61B 'part':37B 'perl':23B,30B 'process':58B 'reject':45B 'repeat':70B 'request':71B 'run':57B 'scalar':50B 'self':25B 'self-host':24B 'string':41B 'temporari':49B 'version':31B 'xs':21B,28B","search_c":"'-8':137C '16':101C '4.04':104C '4.05':76C 'buffer':100C,109C 'charact':131C 'chosen':164C 'content':112C 'control':130C 'decod':81C,89C,94C,152C,155C 'end':140C 'escap':134C 'exhaust':170C 'fail':151C 'fill':110C 'fix':98C 'fixed-s':97C 'free':119C 'input':143C 'invalid':133C 'json':72C 'keep':147C 'kib':102C 'leak':79C 'long':86C 'malform':135C 'memori':172C 'move':113C 'new':116C 'noth':118C 'part':82C,156C 'perl':78C 'process':145C,171C 'reject':85C,127C,159C 'repeat':168C 'request':169C 'retain':153C 'run':148C 'scalar':117C,121C 'sender':167C 'size':99C,163C 'str':90C 'string':87C,92C,124C,160C 'time':107C 'utf':136C 'version':74C 'xs':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124541","severity":null,"published_at":"2026-11-14T12:17:43+00:00","modified_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:30+00:00","fetched_at":"2026-11-14T12:28:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}