CVE-2026-124540
Received Received - Intake

Stack Exhaustion in JSON::XS Perl Module

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: CPANSec

Description
JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-124540
EUVD
EUVD-2026-125918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perl json_xs to 4.05 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack exhaustion issue in JSON::XS versions before 4.05 for Perl. It occurs when the allow_tags feature is used during JSON decoding. The problem arises because tagged values starting with '(' are decoded recursively without being limited by the max_depth setting. This allows deeply nested tagged values to exhaust the C stack, leading to an uncatchable segmentation fault.

Detection Guidance

This vulnerability can be detected by checking the version of JSON::XS installed on your system. Run the command 'perl -MJSON::XS -e "print JSON::XS->VERSION"' to check the version. If it is below 4.05, the system is vulnerable.

Impact Analysis

If you use JSON::XS with allow_tags enabled in versions before 4.05, an attacker could send specially crafted JSON data to trigger stack exhaustion. This would cause your application to crash with a segmentation fault, potentially leading to denial of service. The crash is uncatchable, meaning standard error handling won't prevent it.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical issue in a Perl module (JSON::XS) that causes stack exhaustion and crashes. Compliance implications would depend on how the affected software is used in a system handling regulated data.

Mitigation Strategies

Immediately update JSON::XS to version 4.05 or later using your package manager, such as 'cpan JSON::XS' or 'apt-get install libjson-xs-perl' for Debian-based systems. Avoid using the allow_tags feature in JSON::XS until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124540. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...