========================================================================
CVE-2026-124541                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-124541

   Distribution:  JSON-XS
       Versions:  before 4.05
       MetaCPAN:  https://metacpan.org/dist/JSON-XS
       VCS Repo:  https://cvs.schmorp.de/JSON-XS/

JSON::XS versions before 4.05 for Perl leak the decoded part of a
rejected long string in decode_str

Description
-----------
JSON::XS versions before 4.05 for Perl leak the decoded part of a
rejected long string in decode_str.

A string is decoded through a fixed-size buffer (16 KiB in 4.04), and
each time the buffer fills its contents move into a new scalar. Nothing
frees that scalar when the string is then rejected for a control
character, an invalid escape, malformed UTF-8 or the end of the input.

A process that keeps running after a failed decode retains the decoded
part of each rejected string, with its size chosen by the sender.
Repeated requests exhaust process memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to JSON-XS 4.05 or later.

References
----------
https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes

Timeline
--------
- 2026-11-13: Version 4.05 released with fix.