CVE-2026-124541

JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decodestr. A string is decoded through a fixed-size buffer 16 KiB in 4.04, and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a...

CVE-2026-124541

The JSON::XS module for Perl (versions before 4.05) is vulnerable to a memory leak in the decode_str function. When decoding strings, the module uses a fixed-size buffer; once filled, contents are moved into new scalars. If the input string is rejected due to control characters, invalid escapes, ...

CVE-2026-124541 JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str

JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decodestr. A string is decoded through a fixed-size buffer 16 KiB in 4.04, and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a...

EUVD-2026-125917

JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decodestr. A string is decoded through a fixed-size buffer 16 KiB in 4.04, and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a...

CVE-2026-124541: Missing Release of Memory after Effective Lifetime

JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decodestr. A string is decoded through a fixed-size buffer 16 KiB in 4.04, and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a...