CVE-2026-129113: JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number

JSON::XS versions from 4.000 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incrskip after a top-level number.

The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incrparse call without new input reads them again and moves the offset past the end of the buffer. incrskip, the documented recovery after an error, removes that many bytes and the buffer length wraps.

A peer sending input such as "1-2" to an incrparse consumer can make the next read of incrtext exit the process through perl's uncatchable out-of-memory path.