CVE-2026-129114

Name of the Vulnerable Software and Affected Versions JSON::XS versions 3.04 through 4.04

Description An issue exists in the incr parse() function where a one-byte heap out-of-bounds write occurs when appending a one-byte chunk. This happens because the incremental buffer grows to one and a half times the required length without reserving space for the terminating NUL character. In cases involving an empty buffer and a one-byte chunk, the NUL character is written one byte past the allocation if no reallocation occurs. A peer streaming data to an incr parse consumer can trigger this by controlling how input is split into reads.

Recommendations Update JSON::XS to version 4.05 or later.