CVE-2026-129113

Name of the Vulnerable Software and Affected Versions JSON::XS versions 4.0 00 through 4.04

Description An issue exists where the incremental buffer length is corrupted by chopping past its end in the incr skip() function after a top-level number. The incremental parser treats sequences of digits, signs, dots, and exponent markers as a single number, while the decoder stops at the end of a valid number, leaving an offset of undecoded bytes. When the buffer is emptied without clearing these bytes, a subsequent incr parse() call without new input reads them again and moves the offset beyond the buffer end. Consequently, incr skip() removes those bytes, causing the buffer length to wrap. An attacker sending input like "1-2" to an incr parse consumer can trigger a process exit via an uncatchable out-of-memory path in Perl.

Recommendations Update JSON::XS to version 4.05 or later.