{"id":"CVE-2026-129113","kind":"vulnerability","aliases":["CVE-2026-129113"],"related":[],"title":"JSON::XS (Perl): incremental parser bug lets a peer crash the process","description":"JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number.\n\nThe incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps.\n\nA peer sending input such as \"1-2\" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.","summary":"JSON::XS versions from 4.0_00 before 4.05 corrupt the incremental parser's buffer length after a top-level number, so input such as \"1-2\" sent to an incremental consumer can make the next read exit the process through perl's out-of-memory path. The sources describe a process crash, not code execution.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["json-xs","network-services","package","perl"],"not_affected_if":["non-incremental-parsing","versions-4.05-or-later"],"how_to_check":"- `perl -MJSON::XS -e 'print $JSON::XS::VERSION'` to read the installed version\n- Search your Perl dependencies for JSON::XS and check whether any code calls incr_parse or incr_text on untrusted input","fix":"- JSON::XS `4.05` or later (the sources give 'before 4.05' as the fixed boundary)","status":"open","published_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","triaged_at":"2026-11-14T12:30:32+00:00","updated_at":"2026-11-14T12:30:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T12:30:32Z","model":"claude-haiku-5-5","output":{"fix":"- JSON::XS `4.05` or later (the sources give 'before 4.05' as the fixed boundary)","reach":"network","title":"JSON::XS (Perl): incremental parser bug lets a peer crash the process","impact":"low","summary":"JSON::XS versions from 4.0_00 before 4.05 corrupt the incremental parser's buffer length after a top-level number, so input such as \"1-2\" sent to an incremental consumer can make the next read exit the process through perl's out-of-memory path. The sources describe a process crash, not code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","json-xs","network-services"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"a remote peer crashes the Perl process via out-of-memory","analyst_note":"Check the NVD entry and the JSON::XS changelog for the exact fixed version and whether the crash is the only effect.","how_to_check":"- `perl -MJSON::XS -e 'print $JSON::XS::VERSION'` to read the installed version\n- Search your Perl dependencies for JSON::XS and check whether any code calls incr_parse or incr_text on untrusted input","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-incremental-parsing","versions-4.05-or-later"],"who_is_affected":"Exposure needs a Perl program that uses JSON::XS's incremental parser (incr_parse and incr_text) on input a remote peer can send. Programs that only decode complete JSON documents with decode_json are not described as affected. unknown whether other parsers or configurations are involved beyond what the sources state.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4716,"output_tokens":615,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-129113':15A,18A '-2':53B,207C '-2026':14A,17A '00':32B,89C '1':52B,206C '4.0':31B,88C '4.05':34B,91C 'buffer':40B,97C,156C,182C,197C 'bug':6A 'byte':147C,160C,194C 'call':166C 'chop':100C 'clear':158C 'code':82B 'consum':58B,212C 'corrupt':35B,94C 'crash':10A,80B 'cve':13A,16A 'decod':131C,151C 'describ':77B 'digit':120C 'document':186C 'dot':122C 'empti':154C 'end':103C,135C,179C 'error':190C 'execut':83B 'exit':64B,221C 'expon':124C 'incr':105C,164C,183C,210C,219C 'increment':4A,37B,57B,96C,114C 'input':49B,169C,203C 'json':1A,20B,27B,84C 'json-x':19B 'keep':143C 'later':163C 'length':41B,98C,198C 'let':7A 'level':46B,111C 'make':60B,214C 'mani':193C 'marker':125C 'memori':73B,231C 'move':174C 'network':23B 'network-servic':22B 'new':168C 'next':62B,216C 'number':47B,112C,128C,139C 'offset':145C,176C 'one':127C 'out-of-memori':70B,228C 'packag':25B 'pars':165C,211C 'parser':5A,38B,115C,142C 'past':101C,177C 'path':74B,232C 'peer':9A,201C 'perl':3A,26B,68B,93C,225C 'process':12A,66B,79B,223C 'read':63B,170C,217C 'recoveri':187C 'remov':191C 'run':118C 'scan':116C 'send':202C 'sent':54B 'servic':24B 'sign':121C 'skip':106C,184C 'sourc':76B 'stop':132C 'text':220C 'top':45B,110C 'top-level':44B,109C 'uncatch':227C 'valid':138C 'version':29B,86C 'without':157C,167C 'wrap':199C 'xs':2A,21B,28B,85C","nicknames":[],"mitigations":[],"who_affected":"Exposure needs a Perl program that uses JSON::XS's incremental parser (incr_parse and incr_text) on input a remote peer can send. Programs that only decode complete JSON documents with decode_json are not described as affected. unknown whether other parsers or configurations are involved beyond what the sources state.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jsonxs","medium","networkservices","package","perl"],"campaign_type":null,"search_a":"'-129113':15A,18A '-2026':14A,17A 'bug':6A 'crash':10A 'cve':13A,16A 'increment':4A 'json':1A 'let':7A 'parser':5A 'peer':9A 'perl':3A 'process':12A 'xs':2A","search_b":"'-2':53B '00':32B '1':52B '4.0':31B '4.05':34B 'buffer':40B 'code':82B 'consum':58B 'corrupt':35B 'crash':80B 'describ':77B 'execut':83B 'exit':64B 'increment':37B,57B 'input':49B 'json':20B,27B 'json-x':19B 'length':41B 'level':46B 'make':60B 'memori':73B 'network':23B 'network-servic':22B 'next':62B 'number':47B 'out-of-memori':70B 'packag':25B 'parser':38B 'path':74B 'perl':26B,68B 'process':66B,79B 'read':63B 'sent':54B 'servic':24B 'sourc':76B 'top':45B 'top-level':44B 'version':29B 'xs':21B,28B","search_c":"'-2':207C '00':89C '1':206C '4.0':88C '4.05':91C 'buffer':97C,156C,182C,197C 'byte':147C,160C,194C 'call':166C 'chop':100C 'clear':158C 'consum':212C 'corrupt':94C 'decod':131C,151C 'digit':120C 'document':186C 'dot':122C 'empti':154C 'end':103C,135C,179C 'error':190C 'exit':221C 'expon':124C 'incr':105C,164C,183C,210C,219C 'increment':96C,114C 'input':169C,203C 'json':84C 'keep':143C 'later':163C 'length':98C,198C 'level':111C 'make':214C 'mani':193C 'marker':125C 'memori':231C 'move':174C 'new':168C 'next':216C 'number':112C,128C,139C 'offset':145C,176C 'one':127C 'out-of-memori':228C 'pars':165C,211C 'parser':115C,142C 'past':101C,177C 'path':232C 'peer':201C 'perl':93C,225C 'process':223C 'read':170C,217C 'recoveri':187C 'remov':191C 'run':118C 'scan':116C 'send':202C 'sign':121C 'skip':106C,184C 'stop':132C 'text':220C 'top':110C 'top-level':109C 'uncatch':227C 'valid':138C 'version':86C 'without':157C,167C 'wrap':199C 'xs':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129113","severity":null,"published_at":"2026-11-14T12:17:43+00:00","modified_at":"2026-11-14T12:17:43+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","fetched_at":"2026-11-14T12:28:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}