{"id":"CVE-2026-129114","kind":"vulnerability","aliases":["CVE-2026-129114"],"related":[],"title":"JSON::XS for Perl: one-byte heap overflow when parsing streamed JSON","description":"JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse.\n\nThe incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation.\n\nA peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.","summary":"JSON::XS, a Perl module for encoding and decoding JSON, writes one NUL byte past a heap buffer when incremental parsing appends a one-byte chunk. A peer that controls how its JSON is split into reads can use this to corrupt memory in the consuming process.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["json-xs","package","perl"],"not_affected_if":["not-incremental-parsing","versions-outside-range"],"how_to_check":"- Run `perl -MJSON::XS -e 'print $JSON::XS::VERSION'` and compare the output against the affected range 3.04 to before 4.05.\n- Search dependency manifests and lockfiles for `JSON::XS` and any Perl application that calls `incr_parse`.","fix":"- JSON::XS `4.05` or later (fixed version per the affected range before 4.05).","status":"open","published_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","triaged_at":"2026-11-14T12:30:35+00:00","updated_at":"2026-11-14T12:30:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T12:30:35Z","model":"claude-haiku-5-5","output":{"fix":"- JSON::XS `4.05` or later (fixed version per the affected range before 4.05).","reach":"network","title":"JSON::XS for Perl: one-byte heap overflow when parsing streamed JSON","impact":"medium","summary":"JSON::XS, a Perl module for encoding and decoding JSON, writes one NUL byte past a heap buffer when incremental parsing appends a one-byte chunk. A peer that controls how its JSON is split into reads can use this to corrupt memory in the consuming process.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","json-xs"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"one-byte heap write may corrupt memory in the parsing process","analyst_note":"Sources were NVD only; no CVSS score or exploitation status was given, so severity is unknown beyond the described memory corruption.","how_to_check":"- Run `perl -MJSON::XS -e 'print $JSON::XS::VERSION'` and compare the output against the affected range 3.04 to before 4.05.\n- Search dependency manifests and lockfiles for `JSON::XS` and any Perl application that calls `incr_parse`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-incremental-parsing","versions-outside-range"],"who_is_affected":"Only Perl code that uses JSON::XS in incremental mode (incr_parse) on data from a peer that controls how the input is split into reads is exposed. Applications that only decode complete JSON strings in one call, or that do not use JSON::XS at all, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000768,"input_tokens":4666,"output_tokens":603,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-129114':16A,19A '-2026':15A,18A '3.04':77C '4.05':79C 'alloc':162C 'alreadi':148C 'append':46B,90C 'bound':190C 'buffer':42B,88C,101C,125C,139C 'byte':7A,38B,50B,84C,94C,130C,136C,159C,185C 'caus':181C 'choos':172C 'chunk':51B,95C,131C 'consum':71B,171C 'control':55B 'corrupt':67B 'cve':14A,17A 'data':166C 'decod':33B,146C 'earlier':145C 'empti':124C 'encod':31B 'front':141C 'grow':102C 'half':107C 'heap':8A,41B,87C,186C 'hold':113C 'incr':97C,169C 'increment':44B,100C 'input':175C 'json':1A,13A,21B,25B,34B,58B,73C 'json-x':20B 'land':157C 'length':110C 'memori':68B 'modul':29B 'must':112C 'noth':151C 'nul':37B,121C,156C 'one':6A,36B,49B,83C,93C,104C,129C,135C,158C,184C 'one-byt':5A,48B,92C,128C,183C 'out-of-bound':187C 'overflow':9A 'packag':23B 'pars':11A,45B,98C,170C 'past':39B,85C,160C 'peer':53B,164C 'perl':4A,24B,28B,81C 'process':72B 'read':62B,179C 'realloc':153C 'remov':143C 'request':133C 'reserv':117C 'room':116C 'split':60B,177C 'stream':12A,165C 'termin':120C 'time':108C 'use':64B 'version':75C 'whose':140C 'write':35B,82C,191C 'xs':2A,22B,26B,74C","nicknames":[],"mitigations":[],"who_affected":"Only Perl code that uses JSON::XS in incremental mode (incr_parse) on data from a peer that controls how the input is split into reads is exposed. Applications that only decode complete JSON strings in one call, or that do not use JSON::XS at all, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jsonxs","medium","package","perl"],"campaign_type":null,"search_a":"'-129114':16A,19A '-2026':15A,18A 'byte':7A 'cve':14A,17A 'heap':8A 'json':1A,13A 'one':6A 'one-byt':5A 'overflow':9A 'pars':11A 'perl':4A 'stream':12A 'xs':2A","search_b":"'append':46B 'buffer':42B 'byte':38B,50B 'chunk':51B 'consum':71B 'control':55B 'corrupt':67B 'decod':33B 'encod':31B 'heap':41B 'increment':44B 'json':21B,25B,34B,58B 'json-x':20B 'memori':68B 'modul':29B 'nul':37B 'one':36B,49B 'one-byt':48B 'packag':23B 'pars':45B 'past':39B 'peer':53B 'perl':24B,28B 'process':72B 'read':62B 'split':60B 'use':64B 'write':35B 'xs':22B,26B","search_c":"'3.04':77C '4.05':79C 'alloc':162C 'alreadi':148C 'append':90C 'bound':190C 'buffer':88C,101C,125C,139C 'byte':84C,94C,130C,136C,159C,185C 'caus':181C 'choos':172C 'chunk':95C,131C 'consum':171C 'data':166C 'decod':146C 'earlier':145C 'empti':124C 'front':141C 'grow':102C 'half':107C 'heap':87C,186C 'hold':113C 'incr':97C,169C 'increment':100C 'input':175C 'json':73C 'land':157C 'length':110C 'must':112C 'noth':151C 'nul':121C,156C 'one':83C,93C,104C,129C,135C,158C,184C 'one-byt':92C,128C,183C 'out-of-bound':187C 'pars':98C,170C 'past':85C,160C 'peer':164C 'perl':81C 'read':179C 'realloc':153C 'remov':143C 'request':133C 'reserv':117C 'room':116C 'split':177C 'stream':165C 'termin':120C 'time':108C 'version':75C 'whose':140C 'write':82C,191C 'xs':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129114","severity":null,"published_at":"2026-11-14T12:17:44+00:00","modified_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","fetched_at":"2026-11-14T12:28:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}