========================================================================
CVE-2026-124539                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-124539

   Distribution:  JSON-XS
       Versions:  before 4.05
       MetaCPAN:  https://metacpan.org/dist/JSON-XS
       VCS Repo:  https://cvs.schmorp.de/JSON-XS/

JSON::XS versions before 4.05 for Perl leak the decoded key of an
object rejected for a missing colon in decode_hv

Description
-----------
JSON::XS versions before 4.05 for Perl leak the decoded key of an
object rejected for a missing colon in decode_hv.

Unless it is short plain ASCII, a quoted key is decoded into a new
scalar. Nothing frees that scalar when the object is rejected for a
missing ':' after the key.

A process that keeps running after a failed decode retains one key per
rejected document, with its size chosen by the sender. Repeated
requests exhaust process memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to JSON-XS 4.05 or later.

References
----------
https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes

Timeline
--------
- 2026-11-13: Version 4.05 released with fix.