[<prev] [next>] [day] [month] [year] [list]
Message-ID: <25b3c572-4f05-4352-8c58-88df2b364dd6@fastmail.net>
Date: Mon, 8 Sep 2025 16:44:20 +0100
From: Robert Rothenberg <rob@...tmail.net>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40930: JSON::SIMD before version 1.07 and earlier for Perl
has an integer buffer overflow causing a segfault when parsing crafted JSON,
enabling denial-of-service attacks or other unspecified impact
========================================================================
CVE-2025-40930 CPAN Security Group
========================================================================
CVE ID: CVE-2025-40930
Distribution: JSON-SIMD
Versions: before 1.07
MetaCPAN: https://metacpan.org/dist/JSON-SIMD
VCS Repo: https://github.com/pjuhasz/JSON-SIMD
JSON::SIMD before version 1.07 and earlier for Perl has an integer
buffer overflow causing a segfault when parsing crafted JSON, enabling
denial-of-service attacks or other unspecified impact
Description
-----------
JSON::SIMD before version 1.07 and earlier for Perl has an integer
buffer overflow causing a segfault when parsing crafted JSON, enabling
denial-of-service attacks or other unspecified impact.
Problem types
-------------
- CWE-122 Heap-based Buffer Overflow
Solutions
---------
Update to 1.07, or apply the provided patch
References
----------
https://metacpan.org/release/PJUHASZ/JSON-SIMD-1.06/source/SIMD.xs#L248
https://metacpan.org/release/PJUHASZ/JSON-SIMD-1.07/changes
https://github.com/pjuhasz/JSON-SIMD/commit/9a87de7331c9fa5198cae404a83b17649cf7b918.patch
Credits
-------
Michael Hudak of rasotec, reporter
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
