Threats affecting pkg:cpan/JSON-XS

CVE-2026-129115 is a use-after-free vulnerability in JSON::XS for Perl versions 3.0 up to but not including 4.05. The flaw occurs when encoding objects with allow_tags enabled, where the FREEZE method's serialization can cause the Perl stack to grow and reallocate, leaving saved pointers referencing freed memory. This can lead to reading freed stack memory and potentially returning undefined values without error during encoding.

JSON::XS versions from 3.04 up to but not including 4.05 for Perl contain an off-by-one error in the incr_parse function. This flaw causes the software to write one byte past the end of a heap buffer when appending a one-byte chunk during incremental parsing. The issue arises because the incremental buffer grows to one and a half times the required length without reserving space for the terminating NUL byte, leading to a heap out-of-bounds write under certain input conditions. The vulnerability is fixed in version 4.05.

CVE-2026-129113 is an integer underflow vulnerability in JSON::XS for Perl versions from 4.0_00 before 4.05. The flaw occurs in the incremental parser's buffer length management when parsing top-level numbers, leading to buffer corruption and potential process termination due to an out-of-memory error.

CVE-2026-124541 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs in the decode_str function, where decoded parts of rejected long strings are not freed properly. This leads to retained memory from each rejected string, potentially exhausting process memory over time.

CVE-2026-124540 is a vulnerability in JSON::XS for Perl before version 4.05 that allows stack exhaustion via uncontrolled recursion when decoding nested tagged values with allow_tags enabled. This leads to an uncatchable segmentation fault caused by C stack exhaustion regardless of the max_depth setting.

CVE-2026-124539 is a memory leak vulnerability in JSON::XS for Perl versions before 4.05. The flaw occurs when decoding an object with a missing colon after a key, causing the decoded key scalar to not be freed. This results in a memory leak where each rejected document retains one key in memory, potentially exhausting process memory over time.

CVE-2026-124536 is a vulnerability in JSON::XS for Perl versions before 4.05 that allows memory exhaustion. The flaw arises because the incremental parser buffers input beyond the configured max_size limit when a NUL byte is present, leading to unbounded memory growth. This can cause the process to exhaust available memory when processing crafted input streams.