CVE-2026-124540: JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag

Q: Which deployments are exposed to this issue?

Deployments using JSON::XS versions before 4.05 are exposed when decoding input with allow_tags enabled. The affected path is decode_tag.

Q: What does an attacker need to trigger the failure?

An attacker needs to supply JSON input that is decoded with allow_tags enabled. A sequence of opening parenthesis bytes can create recursively nested tagged values and exhaust the C stack.

Q: Does configuring max_depth prevent exploitation?

No. Tagged-value nesting is not counted against max_depth, so the stack exhaustion can occur regardless of that setting.

Q: What is the impact and how can it be remediated?

Successful triggering causes an uncatchable segmentation fault, resulting in a process crash. Update JSON::XS to version 4.05 or later; where that is not immediately possible, avoid decoding untrusted input with allow_tags enabled.

Published Nov 14, 2026

Updated

JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag.

With allowtags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against maxdepth.

A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of maxdepth.

Affected Software

4 affected components

debian/libjson-xs-perl*

debian/libjson-xs-perl<=4.040-1~deb12u1, <=4.040-1~deb13u1, <=4.040-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.05

Event History

Nov 14, 2026

CVE Published

via MITRE·11:52 AM

Data Sourced

via MITRE·11:52 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionWeakness

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using JSON::XS versions before 4.05 are exposed when decoding input with allow_tags enabled. The affected path is decode_tag.

What does an attacker need to trigger the failure?

An attacker needs to supply JSON input that is decoded with allow_tags enabled. A sequence of opening parenthesis bytes can create recursively nested tagged values and exhaust the C stack.

Does configuring max_depth prevent exploitation?

No. Tagged-value nesting is not counted against max_depth, so the stack exhaustion can occur regardless of that setting.

What is the impact and how can it be remediated?

Successful triggering causes an uncatchable segmentation fault, resulting in a process crash. Update JSON::XS to version 4.05 or later; where that is not immediately possible, avoid decoding untrusted input with allow_tags enabled.

CVE-2026-124540: JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the failure?

Does configuring max_depth prevent exploitation?

What is the impact and how can it be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to trigger the failure?

Does configuring max_depth prevent exploitation?

What is the impact and how can it be remediated?