[<prev] [next>] [day] [month] [year] [list]
Message-ID: <37b51746-e74b-48c4-8181-46b3a1c47c42@cpan.org>
Date: Mon, 8 Sep 2025 16:42:08 +0100
From: Robert Rothenberg <rrwo@...n.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40928: JSON::XS before version 4.04 for Perl has an integer
buffer overflow causing a segfault when parsing crafted JSON, enabling
denial-of-service attacks or other unspecified
========================================================================
CVE-2025-40928 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40928
Distribution: JSON-XS
Versions: before 4.04
MetaCPAN: https://metacpan.org/dist/JSON-XS
VCS Repo: https://cvs.schmorp.de/JSON-XS/
JSON::XS before version 4.04 for Perl has an integer buffer overflow
causing a segfault when parsing crafted JSON, enabling
denial-of-service attacks or other unspecified impact
Description
-----------
JSON::XS before version 4.04 for Perl has an integer buffer overflow
causing a segfault when parsing crafted JSON, enabling
denial-of-service attacks or other unspecified impact
Problem types
-------------
- CWE-122 Heap-based Buffer Overflow
Solutions
---------
Update to 4.04, or apply the provided patch
References
----------
https://metacpan.org/release/MLEHMANN/JSON-XS-4.03/source/XS.xs#L256
https://security.metacpan.org/patches/J/JSON-XS/4.03/CVE-2025-40928-r1.patch
Credits
-------
Michael Hudak of rasotec, reporter
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
