---
id: "CVE-2026-129113"
page: "https://infrastack.ai/live/CVE-2026-129113"
kind: "vulnerability"
aliases: ["CVE-2026-129113"]
title: "JSON::XS (Perl): incremental parser bug lets a peer crash the process"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["json-xs", "network-services", "package", "perl"]
not_affected_if: ["non-incremental-parsing", "versions-4.05-or-later"]
published_at: "2026-11-14T12:17:43+00:00"
first_seen_at: "2026-11-14T12:28:31+00:00"
updated_at: "2026-11-14T12:30:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129113", "first_seen_at": "2026-11-14T12:28:31+00:00"}]
exploit_sources: []
---

# JSON::XS (Perl): incremental parser bug lets a peer crash the process

Link for people: https://infrastack.ai/live/CVE-2026-129113 (this .md is for agents)

JSON::XS versions from 4.0_00 before 4.05 corrupt the incremental parser's buffer length after a top-level number, so input such as "1-2" sent to an incremental consumer can make the next read exit the process through perl's out-of-memory path. The sources describe a process crash, not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `perl -MJSON::XS -e 'print $JSON::XS::VERSION'` to read the installed version
- Search your Perl dependencies for JSON::XS and check whether any code calls incr_parse or incr_text on untrusted input

## Fix

- JSON::XS `4.05` or later (the sources give 'before 4.05' as the fixed boundary)

## Timeline

- 2026-11-14T12:28:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129113

## From the sources

JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number.

The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps.

A peer sending input such as "1-2" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_