Executive Summary

This vulnerability is an integer buffer overflow in the legacy floating point number parser of the JSON::SIMD Perl module (before version 1.07). When parsing specially crafted JSON input, the legacy parser can read beyond the allocated memory buffer, causing a segmentation fault. This flaw occurs only when the legacy decoder is explicitly enabled or when the simdjson decoder falls back to the legacy parser under certain compile-time options. The issue allows denial-of-service attacks by crashing the parser. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause the JSON::SIMD parser to crash (segmentation fault) when processing maliciously crafted JSON input. This leads to denial-of-service (DoS) attacks, potentially disrupting applications or services that rely on JSON::SIMD for JSON parsing. Other unspecified impacts are possible but not detailed. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the JSON::SIMD Perl module's legacy floating point parser with specially crafted JSON input designed to trigger the buffer overread and segmentation fault. One approach is to run a test similar to the one added in the patch's test file, which decodes a JSON array containing a floating point number with very long sequences of digits (e.g., 1000 repeated '1's before and after the decimal point). There are no specific network detection commands provided, but locally you can attempt to parse such crafted JSON inputs using JSON::SIMD with the legacy decoder enabled (JSON::SIMD->new->use_simdjson(0)) and observe if a crash or segfault occurs. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating JSON::SIMD to a version later than 1.07 where the patch fixing this vulnerability is applied. If updating is not immediately possible, avoid enabling the legacy floating point parser by not disabling the simdjson decoder (i.e., do not use JSON::SIMD->new->use_simdjson(0)). Also, avoid compiling the module with USE_LONG_DOUBLE or USE_QUADMATH options that cause fallback to the legacy parser. These steps prevent triggering the vulnerable code path and mitigate potential denial-of-service attacks. [1]

Useful 0 Not Useful 0