Threats tagged 'ghsa-w99q-7mg2-3mhx'

JSON::XS versions from 3.0 up to but not including 4.05 for Perl have a vulnerability where reading freed stack memory can occur during serialization with allow_tags enabled. This happens when an object's FREEZE method returns values that cause the Perl stack to grow and be reallocated, leaving saved pointers referencing freed memory. The encoding process may then read this freed memory and can return undef without an error.