{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"JSON-XS","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"4.05","status":"affected","version":"3.04","versionType":"custom"}]}],"cveId":"CVE-2026-129114","cwes":["CWE-193","CWE-122"],"description":"JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse.\n\nThe incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation.\n\nA peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794657232483,"publishedAt":1794657232483,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to JSON-XS 4.05 or later."}],"revision":"c3ca15105cd0ee2b3fbeaa6a771a078c5d035b770370e8540bd11555b19c07d2","sources":[{"modifiedAt":1794657232483,"name":"CNA: CPANSec","retrievedAt":1794658105895,"url":"https://www.cve.org/CVERecord?id=CVE-2026-129114"}],"ssvc":null,"status":"published","title":"JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse","updatedAt":1794658105895}