CVE-2025-40929 - Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Back Back to CVE browser

MEDIUM

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Published Sep 8, 2025

5.6

MEDIUM

CVSS 3.1

EPSS 0.44%

Description

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Affected products

Vendor Rurban Product Cpanel::JSON::XS Default
unaffected
Affected
- ≥ 0, < 4.40

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Rurban	Cpanel::JSON::XS	unaffected	Affected ≥ 0, < 4.40

Remediation

Vendor solution

Update to 4.40 or later, or apply the provided patch

Weaknesses (1)

CWE-122

References (6)

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2025/09/08/1
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27140		Advisory
https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch		patch
https://lists.debian.org/debian-lts-announce/2025/09/msg00034.html
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713		related
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes		release-notes

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CPANSec

Published Sep 8, 2025

Updated Nov 4, 2025

Reserved Apr 16, 2025

Link CVE-2025-40929

CISA Vulnrichment

Updated Sep 8, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-40929

Red Hat

No data

ENISA EUVD

Assigner CPANSec

Published Sep 8, 2025

Updated Nov 4, 2025

Link EUVD-2025-27140

GitHub

No data