Memory Exhaustion in Perl's JSON::XS Affects Various Implementations
CVE-2026-124536
What is CVE-2026-124536?
A vulnerability exists in JSON::XS versions prior to 4.05 for Perl, where the parser can be exploited to exhaust memory by buffering incremental input past the defined max_size after encountering a NUL byte during parsing. Due to the way the parser operates, it appends each input chunk to a growing buffer and assesses progress against max_size without considering the actual buffer length. As a result, the presence of a NUL byte within the initial max_size bytes leads to a situation where memory consumption continues unchecked, particularly when streaming data to an incr_parse consumer. This flaw can be leveraged to deplete process memory, potentially impacting the stability and performance of applications utilizing the affected version of JSON::XS.