JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact
don't accumulate initial whitespace in the incremental buffer (this can be useful to allow whitespace-keepalive on a tcp connection without triggering the max_size limit).
properly croak on some invalid inputs that are not strings (e.g. undef) when trying to decode a json text (reported and analyzed by Goro Fuji).