{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"JSON-XS","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"4.05","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-124540","cwes":["CWE-674"],"description":"JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.\n\nWith allow_tags, \"(\" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.\n\nA run of \"(\" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794657177348,"publishedAt":1794657177348,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to JSON-XS 4.05 or later."}],"revision":"378e49695c6dbecf06cb1af568f7d03ed6ad4be02693ee4834a16418366c889a","sources":[{"modifiedAt":1794657177348,"name":"CNA: CPANSec","retrievedAt":1794658102598,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124540"}],"ssvc":null,"status":"published","title":"JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag","updatedAt":1794658102598}