/ 
JSON-XS-4.0
Security Advisories (1)
CVE-2025-40928 (2025-09-08)

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Changes for version 4.0 - 2018-11-16

  • 4.0 pre-release, do not use other than for testing.
  • SECURITY IMPLICATION: this release enables allow_nonref by default for compatibnility with RFC 7159 and newer. See "old" vs. "new" JSON under SECURITY CONSIDERATIONS.
  • reworked the "old" vs. "new" JSON section.
  • add ->boolean_values to provide the values to which booleans decode (requested by Aristotle Pagaltzis).
  • decode would wrongly accept ASCII NUL characters instead of reporting them as trailing garbage.
  • work around what smells like a perl bug w.r.t. exceptions thrown in callbacks.
  • incremental parser now more or less respects allow_nonref.
  • json_xs json-pretty now enables canonical mode.
  • add documentation section about I-JSON.
  • minor documentation fixes/updates.

Documentation

json_xs
JSON::XS commandline utility

Modules

JSON::XS
JSON serialising/deserialising, done correctly and fast
JSON::XS::Boolean
dummy module providing JSON::XS::Boolean

Examples

Other files