Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key.
A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to JSON-XS 4.05 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes |
|
Sat, 14 Nov 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv. Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory. | |
| Title | JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv | |
| Weaknesses | CWE-401 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-14T11:52:36.293Z
Reserved: 2026-11-08T12:32:19.890Z
Link: CVE-2026-124539
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-14T12:17:43.560
Modified: 2026-11-14T12:17:43.560
Link: CVE-2026-124539
Redhat
No data.
OpenCVE Enrichment
No data.