{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"JSON-XS","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"4.05","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-124541","cwes":["CWE-401"],"description":"JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str.\n\nA string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input.\n\nA process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794657192301,"publishedAt":1794657192301,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to JSON-XS 4.05 or later."}],"revision":"cbcb7459b232768a60bb8ebaaf2e24d102537b9e390d3713e11ab419e6f4275f","sources":[{"modifiedAt":1794657192301,"name":"CNA: CPANSec","retrievedAt":1794658103688,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124541"}],"ssvc":null,"status":"published","title":"JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str","updatedAt":1794658103688}