Posted by Robert Rothenberg on Nov 14 CVE-2026-124536 JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse CVE-2026-124539 JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv CVE-2026-124540 JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag...
JSON-XS versions before 4.05 for Perl (7 CVEs)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/706
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing
Posted by Osvaldo J. Filho on Nov 14 Hi, libdca is VideoLAN's DTS Coherent Acoustics decoder. It's effectively unmaintained (VideoLAN confirmed to me it's abandoned and…
CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine
Posted by Robert Rothenberg on Nov 14 CVE-2015-10149 CPAN Security Group CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN…
CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
Posted by Robert Rothenberg on Nov 14 CVE-2011-10042 CPAN Security Group CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN…