JSON::XS versions before 4.05 for Perl have a vulnerability in the incremental parser (incr_parse) that allows memory exhaustion. The parser buffers input chunks and incorrectly handles NUL bytes, causing the buffer to grow beyond the configured max_size limit. This can lead to process memory exhaustion when processing crafted input streams.