CVE-2026-129115
Received Received - Intake

Memory Corruption in JSON::XS Perl Module

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: CPANSec

Description
JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv. With allow_tags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TO_JSON under convert_blessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block. Encoding such objects reads freed memory, and encode can return undef without an error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129115
EUVD
EUVD-2026-125914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perl json_xs From 3.0 (inc) to 4.05 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects JSON::XS versions from 3.0 before 4.05 for Perl. It involves reading freed stack memory when a FREEZE result's serialization grows the Perl stack under allow_tags in encode_rv. Specifically, when allow_tags is used, an object's FREEZE method is called in list context, and returned values are encoded using a saved Perl stack pointer. If encoding a returned value triggers a callback that grows the stack, the stack is reallocated while the saved pointer still points to freed memory, leading to potential memory corruption.

Detection Guidance

This vulnerability is specific to Perl's JSON::XS module versions 3.0 to 4.04 and requires code execution to detect. No direct network or system commands can identify this issue without running vulnerable code. Review installed JSON::XS versions with: perl -MJSON::XS -e 'print $JSON::XS::VERSION' and check if it falls within the affected range (3.0 to 4.04).

If the module is used in applications, audit code for use of allow_tags in encode calls and FREEZE methods that may return values triggering stack growth during serialization.

Impact Analysis

This vulnerability could allow attackers to read sensitive memory contents or cause undefined behavior in applications using vulnerable versions of JSON::XS. It may lead to crashes, data leaks, or incorrect processing of JSON data, especially in applications that rely on allow_tags for custom serialization.

Compliance Impact

This vulnerability involves reading freed stack memory during JSON encoding with specific Perl module configurations, which could lead to undefined behavior or crashes. It does not directly relate to data confidentiality, integrity, or access control issues typically addressed by GDPR or HIPAA. Compliance impact is likely minimal unless the vulnerability enables unauthorized data exposure or processing, which is not indicated here.

Mitigation Strategies

Upgrade JSON::XS to version 4.05 or later to address the stack memory corruption issue in encode_rv with allow_tags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...