{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"JSON-XS","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"4.05","status":"affected","version":"4.0_00","versionType":"custom"}]}],"cveId":"CVE-2026-129113","cwes":["CWE-191"],"description":"JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number.\n\nThe incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps.\n\nA peer sending input such as \"1-2\" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794657217474,"publishedAt":1794657217474,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to JSON-XS 4.05 or later."}],"revision":"2b7aaec5f18cc3266c6015a578606f8e88e648ef5fa56e8b7a7a5b31ba2c7d37","sources":[{"modifiedAt":1794657217474,"name":"CNA: CPANSec","retrievedAt":1794658104800,"url":"https://www.cve.org/CVERecord?id=CVE-2026-129113"}],"ssvc":null,"status":"published","title":"JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number","updatedAt":1794658104800}