CVE-2025-40929

5.6 mediumEPSS 0.5%

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Severity

CVSS 3.1

5.6 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-122
Published: 2025-09-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes
http://www.openwall.com/lists/oss-security/2025/09/08/1
https://lists.debian.org/debian-lts-announce/2025/09/msg00034.html

Check your stack JSON