JSON::XS versions before 4.05 for Perl contain a vulnerability in the decode_str function where rejected long strings leak decoded data. This occurs because decoded string parts are stored in fixed-size buffers that are not freed upon rejection due to control characters, invalid escapes, malformed UTF-8, or premature end of input. A process that continues running after such failed decodes retains these leaked string parts, potentially exhausting memory over repeated requests.