CVE-2026-124536

Name of the Vulnerable Software and Affected Versions JSON::XS versions prior to 4.05

Description An issue exists where memory exhaustion can occur due to the buffering of incremental input beyond the max size limit. This happens when a NUL byte is present in the incr parse() function. The parser appends data chunks to its buffer and compares max size against the progress made rather than the actual buffer length. Because a NUL byte is interpreted as the end of the input, the parser remains under the limit while the buffer continues to grow. Additionally, the incr skip() function cannot remove the NUL byte, allowing a peer streaming data to exhaust process memory.

Recommendations Update JSON::XS to version 4.05 or later.