Memory Leak in JSON::XS Perl Module

Executive Summary

This vulnerability affects the Perl module JSON::XS before version 4.05. When decoding JSON objects, if a key is quoted and not followed by a colon, the module leaks memory by creating a new scalar for the key without freeing it. Repeated failed decodes can exhaust system memory over time.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Perl's JSON::XS library versions before 4.05 and involves memory leaks during JSON parsing. Detection requires checking the installed version of JSON::XS on systems running Perl applications that process JSON data. Use commands like 'perl -MJSON::XS -e "print $JSON::XS::VERSION"' to verify the version. If the version is below 4.05, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable version of JSON::XS in a long-running Perl process, an attacker could send specially crafted JSON data to cause memory exhaustion. This may lead to crashes, degraded performance, or denial of service for the affected application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as described. It is a memory leak issue in a Perl module that could lead to denial-of-service through resource exhaustion, but no data exposure or privacy violation is mentioned.

Useful 0 Not Useful 0

Mitigation Strategies

Update JSON::XS to version 4.05 or later for Perl to address the memory leak issue in object decoding.

Useful 0 Not Useful 0