CVE-2026-124536: JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse

Q: Who is exposed to this issue?

Applications using JSON::XS incremental parsing through incr_parse are exposed if an untrusted peer can stream data to that parser. The affected package is libjson-xs-perl on Debian, and JSON::XS versions before 4.05 are affected.

Q: What does an attacker need to do to trigger memory exhaustion?

The attacker needs to send streaming input containing a NUL byte within the first max_size bytes, then continue supplying chunks. This causes the parser buffer to grow even though max_size is configured.

Q: Does setting max_size prevent exploitation?

No. When a NUL byte occurs early in incremental input, the parser compares max_size against parsing progress rather than the growing buffer length, allowing memory use to grow regardless of max_size.

Q: Can incr_skip clear the malicious buffered input?

No. incr_skip cannot remove the NUL byte that causes this condition, so it cannot be used to recover the parser buffer from the affected input.

Published Nov 14, 2026

Updated

JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past maxsize after a NUL byte in incrparse.

The parser appends each chunk to its buffer and compares maxsize with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first maxsize bytes keeps it short of the limit. The buffer keeps growing, and incrskip cannot remove the NUL.

A peer streaming data to an incrparse consumer can exhaust process memory regardless of maxsize.

Affected Software

4 affected components

debian/libjson-xs-perl*

debian/libjson-xs-perl<=4.040-1~deb12u1, <=4.040-1~deb13u1, <=4.040-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JSON::XS to a version that resolves this vulnerability.
Fixed in 4.05

Event History

Nov 14, 2026

CVE Published

via MITRE·11:51 AM

Data Sourced

via MITRE·11:51 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionWeakness

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using JSON::XS incremental parsing through incr_parse are exposed if an untrusted peer can stream data to that parser. The affected package is libjson-xs-perl on Debian, and JSON::XS versions before 4.05 are affected.

What does an attacker need to do to trigger memory exhaustion?

The attacker needs to send streaming input containing a NUL byte within the first max_size bytes, then continue supplying chunks. This causes the parser buffer to grow even though max_size is configured.

Does setting max_size prevent exploitation?

No. When a NUL byte occurs early in incremental input, the parser compares max_size against parsing progress rather than the growing buffer length, allowing memory use to grow regardless of max_size.

Can incr_skip clear the malicious buffered input?

No. incr_skip cannot remove the NUL byte that causes this condition, so it cannot be used to recover the parser buffer from the affected input.

CVE-2026-124536: JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger memory exhaustion?

Does setting max_size prevent exploitation?

Can incr_skip clear the malicious buffered input?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger memory exhaustion?

Does setting max_size prevent exploitation?

Can incr_skip clear the malicious buffered input?