CVE-2026-124536

*** Pendiente de traducción *** JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse.<br /> <br /> The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL.<br /> <br /> A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.