Memory Exposure in JSON::XS for Perl Affecting MLEHMANN

CVE-2026-129115

What is CVE-2026-129115?

The JSON::XS library for Perl prior to version 4.05 contains a vulnerability that may lead to memory exposure due to improper handling of a freed stack memory. When utilizing the allow_tags option, the object's FREEZE method is executed in a list context, and if the returning values cause a stack growth, it may result in encoding operations reading from freed memory. As a consequence, these operations could yield undefined values without signaling any error, thereby compromising data integrity and potentially leading to other security risks.

References