========================================================================
CVE-2026-129113                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-129113

   Distribution:  JSON-XS
       Versions:  from 4.0_00 before 4.05
       MetaCPAN:  https://metacpan.org/dist/JSON-XS
       VCS Repo:  https://cvs.schmorp.de/JSON-XS/

JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the
incremental buffer length by chopping past its end in incr_skip after a
top-level number

Description
-----------
JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the
incremental buffer length by chopping past its end in incr_skip after a
top-level number.

The incremental parser scans any run of digits, signs, dots and
exponent markers as one number, but the decoder stops at the end of a
valid number, so the parser keeps an offset into bytes it has not
decoded. It then empties the buffer without clearing those bytes, and a
later incr_parse call without new input reads them again and moves the
offset past the end of the buffer. incr_skip, the documented recovery
after an error, removes that many bytes and the buffer length wraps.

A peer sending input such as "1-2" to an incr_parse consumer can make
the next read of incr_text exit the process through perl's uncatchable
out-of-memory path.

Problem types
-------------
- CWE-191 Integer Underflow (Wrap or Wraparound)

Solutions
---------
Upgrade to JSON-XS 4.05 or later.

References
----------
https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes

Timeline
--------
- 2026-11-13: Version 4.05 released with fix.

Credits
-------
Albert Gierlach (rivit), reporter