Memory Leak Vulnerability in JSON::XS for Perl Affecting MLEHMANN

CVE-2026-124541

What is CVE-2026-124541?

The JSON::XS module for Perl prior to version 4.05 has a vulnerability that can lead to a memory leak when processing long strings. The decoding mechanism utilizes a fixed-size buffer, and upon receiving a malformed string or one containing control characters, the internal scalar that retains the rejected string is not released, leading to increased memory usage with each failed decode attempt. As long-running processes continue to handle these bad requests, the memory consumed can accumulate, potentially exhausting system resources.

References