========================================================================
CVE-2026-129114                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-129114

   Distribution:  JSON-XS
       Versions:  from 3.04 before 4.05
       MetaCPAN:  https://metacpan.org/dist/JSON-XS
       VCS Repo:  https://cvs.schmorp.de/JSON-XS/

JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a
heap buffer when appending a one-byte chunk in incr_parse

Description
-----------
JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a
heap buffer when appending a one-byte chunk in incr_parse.

The incremental buffer grows to one and a half times the length it must
hold, with no room reserved for the terminating NUL. For an empty
buffer and a one-byte chunk that request is one byte, which a buffer
whose front was removed by earlier decodes can already have, so nothing
is reallocated and the NUL lands one byte past the allocation.

A peer streaming data to an incr_parse consumer, choosing how the input
is split into reads, can cause a one-byte heap out-of-bounds write.

Problem types
-------------
- CWE-193 Off-by-one Error
- CWE-122 Heap-based Buffer Overflow

Solutions
---------
Upgrade to JSON-XS 4.05 or later.

References
----------
https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes

Timeline
--------
- 2026-11-13: Version 4.05 released with fix.

Credits
-------
Albert Gierlach (rivit), reporter