Stack Exhaustion Vulnerability in Perl JSON::XS by MLEHMANN
CVE-2026-124540

Currently unrated

Key Information:

Status
Vendor
CVE Published:
14 November 2026

What is CVE-2026-124540?

The JSON::XS module in Perl, prior to version 4.05, is susceptible to a stack exhaustion attack. This vulnerability arises when the 'allow_tags' feature is enabled, allowing for nested tagged values during the decoding process. The recursion induced by every tagged value can lead to stack exhaustion, primarily when the input consists of a series of "(" characters. This can result in a segmentation fault, which cannot be caught, leading to application crashes and potential denial of service. Users are advised to upgrade to version 4.05 or later to mitigate this risk.

References

https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.