CVE-2026-129115: JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv

Q: What conditions are required to trigger this issue?

The affected application must use allow_tags with encode_rv and encode an object whose FREEZE method returns values. Exploitation requires encoding one of those returned values to call back into Perl, such as through TO_JSON with convert_blessed or through another FREEZE, in a way that grows and reallocates the Perl stack.

Q: What observable behavior can indicate that an application is affected?

Encoding the relevant object graph can read freed memory and cause encode to return undef without reporting an error. This behavior is associated with FREEZE-based tagged-object serialization where a nested Perl callback grows the stack.

Q: Which versions need remediation?

JSON::XS versions from 3.0 before 4.05 are affected. Version 4.05 is identified as the fixed release in the supplied change reference.

Q: What can be done if updating is not immediately possible?

Avoid the triggering serialization path: do not use allow_tags for affected encoding operations, or avoid object graphs in which FREEZE return values invoke TO_JSON or another FREEZE during encoding. Check for unexpected undef results from encode in these paths.

Published Nov 14, 2026

Updated

JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allowtags in encoderv.

With allowtags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TOJSON under convertblessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block.

Encoding such objects reads freed memory, and encode can return undef without an error.

Affected Software

4 affected components

debian/libjson-xs-perl*

debian/libjson-xs-perl<=4.040-1~deb12u1, <=4.040-1~deb13u1, <=4.040-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JSON::XS to a version that resolves this vulnerability.
Fixed in 4.05

Event History

Nov 14, 2026

CVE Published

via MITRE·11:54 AM

Data Sourced

via MITRE·11:54 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionWeakness

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Frequently Asked Questions

What conditions are required to trigger this issue?

The affected application must use allow_tags with encode_rv and encode an object whose FREEZE method returns values. Exploitation requires encoding one of those returned values to call back into Perl, such as through TO_JSON with convert_blessed or through another FREEZE, in a way that grows and reallocates the Perl stack.

What observable behavior can indicate that an application is affected?

Encoding the relevant object graph can read freed memory and cause encode to return undef without reporting an error. This behavior is associated with FREEZE-based tagged-object serialization where a nested Perl callback grows the stack.

Which versions need remediation?

JSON::XS versions from 3.0 before 4.05 are affected. Version 4.05 is identified as the fixed release in the supplied change reference.

What can be done if updating is not immediately possible?

Avoid the triggering serialization path: do not use allow_tags for affected encoding operations, or avoid object graphs in which FREEZE return values invoke TO_JSON or another FREEZE during encoding. Check for unexpected undef results from encode in these paths.

CVE-2026-129115: JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger this issue?

What observable behavior can indicate that an application is affected?

Which versions need remediation?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this issue?

What observable behavior can indicate that an application is affected?

Which versions need remediation?

What can be done if updating is not immediately possible?