libjson-xs-perl - Debian Package Tracker

general

source: libjson-xs-perl (main)
version: 4.040-1
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: gregor herrmann (DMD) – Niko Tyni (DMD) – Ivan Kohler (DMD) – Ansgar Burchardt (DMD) – Angel Abad (DMD)
arch: any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.030-1
o-o-sec: 4.030-1+deb11u1
oldstable: 4.040-1~deb12u1
old-sec: 4.040-1~deb12u1
stable: 4.040-1~deb13u1
stable-sec: 4.040-1~deb13u1
testing: 4.040-1
unstable: 4.040-1

versioned links

4.030-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.030-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.040-1~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.040-1~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.040-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjson-xs-perl (3 bugs: 0, 2, 1, 0)

action needed

7 security issues in trixie high

There are 7 open security issues in trixie.

7 important issues:

CVE-2026-124536: JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse. The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
CVE-2026-124539: JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv. Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-124540: JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
CVE-2026-124541: JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str. A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input. A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-129113: JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number. The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps. A peer sending input such as "1-2" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.
CVE-2026-129114: JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse. The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation. A peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.
CVE-2026-129115: JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv. With allow_tags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TO_JSON under convert_blessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block. Encoding such objects reads freed memory, and encode can return undef without an error.

Created: 2026-11-14 Last update: 2026-11-15 07:00

7 security issues in sid high

There are 7 open security issues in sid.

7 important issues:

CVE-2026-124536: JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse. The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
CVE-2026-124539: JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv. Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-124540: JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
CVE-2026-124541: JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str. A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input. A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-129113: JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number. The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps. A peer sending input such as "1-2" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.
CVE-2026-129114: JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse. The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation. A peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.
CVE-2026-129115: JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv. With allow_tags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TO_JSON under convert_blessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block. Encoding such objects reads freed memory, and encode can return undef without an error.

Created: 2026-11-14 Last update: 2026-11-15 07:00

7 security issues in forky high

There are 7 open security issues in forky.

7 important issues:

CVE-2026-124536: JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse. The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
CVE-2026-124539: JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv. Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-124540: JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
CVE-2026-124541: JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str. A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input. A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-129113: JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number. The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps. A peer sending input such as "1-2" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.
CVE-2026-129114: JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse. The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation. A peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.
CVE-2026-129115: JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv. With allow_tags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TO_JSON under convert_blessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block. Encoding such objects reads freed memory, and encode can return undef without an error.

Created: 2026-11-14 Last update: 2026-11-15 07:00

7 security issues in bookworm high

There are 7 open security issues in bookworm.

7 important issues:

CVE-2026-124536: JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse. The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
CVE-2026-124539: JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv. Unless it is short plain ASCII, a quoted key is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-124540: JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
CVE-2026-124541: JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str. A string is decoded through a fixed-size buffer (16 KiB in 4.04), and each time the buffer fills its contents move into a new scalar. Nothing frees that scalar when the string is then rejected for a control character, an invalid escape, malformed UTF-8 or the end of the input. A process that keeps running after a failed decode retains the decoded part of each rejected string, with its size chosen by the sender. Repeated requests exhaust process memory.
CVE-2026-129113: JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number. The incremental parser scans any run of digits, signs, dots and exponent markers as one number, but the decoder stops at the end of a valid number, so the parser keeps an offset into bytes it has not decoded. It then empties the buffer without clearing those bytes, and a later incr_parse call without new input reads them again and moves the offset past the end of the buffer. incr_skip, the documented recovery after an error, removes that many bytes and the buffer length wraps. A peer sending input such as "1-2" to an incr_parse consumer can make the next read of incr_text exit the process through perl's uncatchable out-of-memory path.
CVE-2026-129114: JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse. The incremental buffer grows to one and a half times the length it must hold, with no room reserved for the terminating NUL. For an empty buffer and a one-byte chunk that request is one byte, which a buffer whose front was removed by earlier decodes can already have, so nothing is reallocated and the NUL lands one byte past the allocation. A peer streaming data to an incr_parse consumer, choosing how the input is split into reads, can cause a one-byte heap out-of-bounds write.
CVE-2026-129115: JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv. With allow_tags, an object's FREEZE method is called in list context and each returned value is encoded through a saved Perl stack pointer. When encoding a returned value calls back into Perl, through TO_JSON under convert_blessed or another FREEZE, and that callback grows the stack, the stack is reallocated while the saved pointer still refers to the freed block. Encoding such objects reads freed memory, and encode can return undef without an error.

Created: 2026-11-14 Last update: 2026-11-15 07:00

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://metacpan.org/release/JSON-XS failed: 500 read timeout

Created: 2026-11-13 Last update: 2026-11-15 05:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.040-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit eb63e0008ec482ae975bcceb68fa6db57c694abd
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 00:39:16 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit 49c73fd5f10068703849031a3ba62c21ce6db55e
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 00:39:16 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-08 Last update: 2026-11-14 01:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.0).

Created: 2020-11-17 Last update: 2026-03-31 15:01

testing migrations

This package is part of the ongoing testing transition known as perl-5.44. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-09-29] Accepted libjson-xs-perl 4.030-1+deb11u1 (source) into oldoldstable-security (Paride Legovini)
[2025-09-15] Accepted libjson-xs-perl 4.040-1~deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-09-15] Accepted libjson-xs-perl 4.040-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-09-15] libjson-xs-perl 4.040-1 MIGRATED to testing (Debian testing watch)
[2025-09-11] Accepted libjson-xs-perl 4.040-1~deb12u1 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-09-11] Accepted libjson-xs-perl 4.040-1~deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-09-09] Accepted libjson-xs-perl 4.040-1 (source) into unstable (Salvatore Bonaccorso)
[2025-09-08] Accepted libjson-xs-perl 4.030-3 (source) into unstable (Salvatore Bonaccorso)
[2022-09-04] Accepted libjson-xs-perl 4.030-2 (source) into unstable (Jelmer Vernooĳ) (signed by: Jelmer Vernooij)
[2022-09-04] libjson-xs-perl 4.030-2 MIGRATED to testing (Debian testing watch)
[2020-11-02] libjson-xs-perl 4.030-1 MIGRATED to testing (Debian testing watch)
[2020-10-31] Accepted libjson-xs-perl 4.030-1 (source) into unstable (gregor herrmann)
[2019-07-26] libjson-xs-perl 4.020-1 MIGRATED to testing (Debian testing watch)
[2019-07-21] Accepted libjson-xs-perl 4.020-1 (source) into unstable (intrigeri)
[2019-01-29] Accepted libjson-xs-perl 3.040-1~bpo9+1 (source amd64) into stretch-backports, stretch-backports (Andreas Tille)
[2017-10-01] libjson-xs-perl 3.040-1 MIGRATED to testing (Debian testing watch)
[2017-09-26] Accepted libjson-xs-perl 3.040-1 (source amd64) into unstable (Angel Abad)
[2016-12-04] libjson-xs-perl 3.030-1 MIGRATED to testing (Debian testing watch)
[2016-11-28] Accepted libjson-xs-perl 3.030-1 (source amd64) into unstable (Angel Abad)
[2016-09-29] libjson-xs-perl 3.020-1 MIGRATED to testing (Debian testing watch)
[2016-09-20] Accepted libjson-xs-perl 3.020-1 (source) into unstable (Nuno Carvalho) (signed by: gregor herrmann)
[2015-07-13] libjson-xs-perl 3.010-2 MIGRATED to testing (Britney)
[2015-07-07] Accepted libjson-xs-perl 3.010-2 (source) into unstable (gregor herrmann)
[2015-07-03] libjson-xs-perl 3.010-1 MIGRATED to testing (Britney)
[2015-06-27] Accepted libjson-xs-perl 3.010-1 (source) into unstable (gregor herrmann)
[2013-07-09] libjson-xs-perl 2.340-1 MIGRATED to testing (Debian testing watch)
[2013-06-28] Accepted libjson-xs-perl 2.340-1 (source amd64) (gregor herrmann)
[2013-05-24] libjson-xs-perl 2.330-2 MIGRATED to testing (Debian testing watch)
[2013-05-13] Accepted libjson-xs-perl 2.330-2 (source amd64) (gregor herrmann)
[2013-05-05] libjson-xs-perl 2.330-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 4
RC: 0
I&N: 3
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.040-1build1