CVE-2026-129114: JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse

Q: Who is realistically exposed to this issue?

Applications using JSON::XS incremental parsing through incr_parse are exposed when they accept streamed data from a peer that can influence how input is divided into reads. The affected version range is 3.04 through versions before 4.05.

Q: What does an attacker need to control to trigger the bug?

The attacker needs to stream data to an incr_parse consumer and control the input chunk boundaries. The triggering condition involves appending a one-byte chunk after earlier decodes have removed the front of the incremental buffer.

Q: What should be done to remediate it?

Update JSON::XS to version 4.05 or later. Until updating is possible, avoid processing peer-controlled streamed input with incr_parse where the peer can influence read splitting.

Q: How can I determine whether an application may be affected?

Check whether it uses JSON::XS version 3.04 or later but earlier than 4.05, and whether it calls incr_parse on data received incrementally from an external peer. Applications that do not use incr_parse are not described as affected by this issue.

Published Nov 14, 2026

Updated

JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incrparse.

The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation.

A peer streaming data to an incrparse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.

Affected Software

4 affected components

debian/libjson-xs-perl*

debian/libjson-xs-perl<=4.040-1~deb12u1, <=4.040-1~deb13u1, <=4.040-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JSON-XS to a version that resolves this vulnerability.
Fixed in 4.05

Event History

Nov 14, 2026

CVE Published

via MITRE·11:53 AM

Data Sourced

via MITRE·11:53 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionWeakness

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using JSON::XS incremental parsing through incr_parse are exposed when they accept streamed data from a peer that can influence how input is divided into reads. The affected version range is 3.04 through versions before 4.05.

What does an attacker need to control to trigger the bug?

The attacker needs to stream data to an incr_parse consumer and control the input chunk boundaries. The triggering condition involves appending a one-byte chunk after earlier decodes have removed the front of the incremental buffer.

What should be done to remediate it?

Update JSON::XS to version 4.05 or later. Until updating is possible, avoid processing peer-controlled streamed input with incr_parse where the peer can influence read splitting.

How can I determine whether an application may be affected?

Check whether it uses JSON::XS version 3.04 or later but earlier than 4.05, and whether it calls incr_parse on data received incrementally from an external peer. Applications that do not use incr_parse are not described as affected by this issue.

CVE-2026-129114: JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to control to trigger the bug?

What should be done to remediate it?

How can I determine whether an application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to control to trigger the bug?

What should be done to remediate it?

How can I determine whether an application may be affected?