CVE-2026-124541: JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str

Q: Which deployments are realistically exposed to memory exhaustion?

Long-running Perl processes that call decode_str on attacker-controlled input are exposed, because they retain memory after failed decodes rather than releasing it when the request ends. Short-lived processes are less likely to accumulate retained memory across repeated failures.

Q: What must an attacker send to trigger the issue?

The attacker needs to cause decode_str to process a sufficiently long string and then reject it, such as through a control character, invalid escape, malformed UTF-8, or truncated input. Repeating those requests can consume increasing amounts of process memory.

Q: Does a malformed input need to be large?

The input must be long enough to fill the decoder's fixed-size buffer and move decoded contents into a new scalar before the decode fails. In version 4.04, that buffer is 16 KiB.

Q: How can I determine whether an application may be affected?

Check whether it uses JSON::XS before version 4.05 and calls decode_str on inputs that can be supplied by untrusted clients. Memory growth following repeated rejected long JSON strings is an operational indicator of exposure.

Q: What can be done before upgrading?

Limit or reject oversized JSON input before it reaches decode_str, and ensure malformed requests cannot be retried repeatedly against the same long-running process. Restarting affected worker processes can release accumulated memory, but does not prevent further exhaustion attempts.

Published Nov 14, 2026

Updated

JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decodestr.

A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input.

A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.

Affected Software

4 affected components

debian/libjson-xs-perl*

debian/libjson-xs-perl<=4.040-1~deb12u1, <=4.040-1~deb13u1, <=4.040-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JSON::XS to a version that resolves this vulnerability.
Fixed in 4.05

Event History

Nov 14, 2026

CVE Published

via MITRE·11:53 AM

Data Sourced

via MITRE·11:53 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionWeakness

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to memory exhaustion?

Long-running Perl processes that call decode_str on attacker-controlled input are exposed, because they retain memory after failed decodes rather than releasing it when the request ends. Short-lived processes are less likely to accumulate retained memory across repeated failures.

What must an attacker send to trigger the issue?

The attacker needs to cause decode_str to process a sufficiently long string and then reject it, such as through a control character, invalid escape, malformed UTF-8, or truncated input. Repeating those requests can consume increasing amounts of process memory.

Does a malformed input need to be large?

The input must be long enough to fill the decoder's fixed-size buffer and move decoded contents into a new scalar before the decode fails. In version 4.04, that buffer is 16 KiB.

How can I determine whether an application may be affected?

Check whether it uses JSON::XS before version 4.05 and calls decode_str on inputs that can be supplied by untrusted clients. Memory growth following repeated rejected long JSON strings is an operational indicator of exposure.

What can be done before upgrading?

Limit or reject oversized JSON input before it reaches decode_str, and ensure malformed requests cannot be retried repeatedly against the same long-running process. Restarting affected worker processes can release accumulated memory, but does not prevent further exhaustion attempts.

CVE-2026-124541: JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to memory exhaustion?

What must an attacker send to trigger the issue?

Does a malformed input need to be large?

How can I determine whether an application may be affected?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to memory exhaustion?

What must an attacker send to trigger the issue?

Does a malformed input need to be large?

How can I determine whether an application may be affected?

What can be done before upgrading?