https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 15:42:43 +0000 https://db.gcve.eu/vuln/cve-2026-124541 <p><strong>Affected:</strong> JSON-XS</p> <p>JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str.</p> <p>A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input.</p> <p>A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.</p> <p><strong>Affected:</strong> JSON-XS</p> <p>JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str.</p> <p>A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input.</p> <p>A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.</p> https://db.gcve.eu/vuln/cve-2026-124541