Memory Leak Vulnerability in JSON::XS for Perl Affecting MLEHMANN Software
CVE-2026-124539

Currently unrated

Key Information:

Status
Vendor
CVE Published:
14 November 2026

What is CVE-2026-124539?

The JSON::XS module for Perl versions prior to 4.05 contains a vulnerability that causes a memory leak when decoding JSON objects. If a JSON object is rejected due to a missing colon in the key-value pair, the corresponding scalar for the decoded key is not freed. This results in a continuous retention of memory allocated for each rejected document. Consequently, if a process continues to run after a failed decode, it accumulates memory usage, which can lead to exhaustion of process memory over time during repeated requests.

References

https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.