Buffer Corruption in JSON::XS for Perl Affects Multiple Versions

CVE-2026-129113

What is CVE-2026-129113?

The JSON::XS module for Perl is susceptible to a buffer corruption vulnerability that occurs when parsing top-level numbers. During the parsing process, the incremental parser can mismanage the buffer length, leading to uncontrollable behavior if a malicious peer sends malformed input. Specifically, the issue arises in the incr_parse function, which reads data without properly resetting the buffer, ultimately causing a potential out-of-memory scenario in subsequent operations when the buffer wraps around. This vulnerability is critical for developers using JSON::XS versions earlier than 4.05, as it compromises system stability and security.

References