========================================================================
CVE-2026-124536                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-124536

   Distribution:  JSON-XS
       Versions:  before 4.05
       MetaCPAN:  https://metacpan.org/dist/JSON-XS
       VCS Repo:  https://cvs.schmorp.de/JSON-XS/

JSON::XS versions before 4.05 for Perl allow memory exhaustion by
buffering incremental input past max_size after a NUL byte in
incr_parse

Description
-----------
JSON::XS versions before 4.05 for Perl allow memory exhaustion by
buffering incremental input past max_size after a NUL byte in
incr_parse.

The parser appends each chunk to its buffer and compares max_size with
how far it has progressed, not with the buffer length. It treats a NUL
byte as the end of the input, so a NUL within the first max_size bytes
keeps it short of the limit. The buffer keeps growing, and incr_skip
cannot remove the NUL.

A peer streaming data to an incr_parse consumer can exhaust process
memory regardless of max_size.

Problem types
-------------
- CWE-770 Allocation of Resources Without Limits or Throttling

Solutions
---------
Upgrade to JSON-XS 4.05 or later.

References
----------
https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes

Timeline
--------
- 2026-11-13: Version 4.05 released with fix.