JSON::XS versions before 4.05 for Perl have a memory leak vulnerability in the decode_hv function. When decoding an object with a missing colon after a key, the decoded key scalar is not freed if the object is rejected. This causes a process that continues running after failed decodes to retain one key per rejected document, potentially exhausting memory over time.