CVE-2026-124536
Received Received - Intake

Memory Exhaustion in JSON::XS Perl Module

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: CPANSec

Description
JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse. The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-124536
EUVD
EUVD-2026-125920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perl json_xs to 4.05 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in JSON::XS versions before 4.05 for Perl. The parser incorrectly handles incremental input by buffering data past the max_size limit after encountering a NUL byte. Instead of comparing max_size with the buffer length, it checks progress, allowing the buffer to grow indefinitely. This can be exploited by a peer streaming data to consume all available memory.

Detection Guidance

This vulnerability is specific to Perl's JSON::XS module versions before 4.05 and involves memory exhaustion during incremental parsing. Detection requires checking the installed version of JSON::XS on systems running Perl applications that use this module.

Impact Analysis

If you use JSON::XS versions before 4.05 in a Perl application that processes incremental JSON input, an attacker could send specially crafted data to exhaust your system's memory. This may lead to crashes, denial of service, or system instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a memory exhaustion issue in a Perl JSON parser. However, if exploited in a system handling sensitive data, it could lead to denial-of-service, potentially impacting availability requirements under these regulations.

Mitigation Strategies

Update JSON::XS to version 4.05 or later to address the memory exhaustion issue in incremental parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...