CVE-2026-124540

JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

• CWE-674

• https://metacpan.org/release/MLEHMANN/JSON-XS-4.05/changes

Published

Nov 14, 2026

Last Modified

Nov 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12451Use after free in DigitalCredentials in Google Chrome prior …8.3
• CVE-2026-12452Use after free in Downloads in Google Chrome on Android prio…8.8
• CVE-2026-12453Insufficient validation of untrusted input in Input in Googl…4.2
• CVE-2026-124536JSON::XS versions before 4.05 for Perl allow memory exhausti…
• CVE-2026-124539JSON::XS versions before 4.05 for Perl leak the decoded key …
• CVE-2026-12454Race in Safe Browsing in Google Chrome on Mac prior to 149.0…8.3
• CVE-2026-124541JSON::XS versions before 4.05 for Perl leak the decoded part…
• CVE-2026-12455Use after free in Tab Strip in Google Chrome prior to 149.0.…7.5
• CVE-2026-124551ClassroomIO through 1.0.0 contains an authorization bypass v…5.3
• CVE-2026-124552Webmin through 2.670 contains a stored cross-site scripting …4.8
• CVE-2026-124553BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaus…7.5
• CVE-2026-124554A security flaw has been discovered in JeecgBoot 3.9.5. This…7.3