CVE-2025-40928

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

7.5 HighFix available

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.70%Up 0.6 points since Sep 9, 2025

What each source reports

CVE List Score used7.5

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: CVE-2025-40928
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2025-271417.5

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: EUVD-2025-27141
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v8qr-gpx9-78rm7.5

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when...

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: GHSA-v8qr-gpx9-78rm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-02

NVD7.5

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: CVE-2025-40928
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-409287.5

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: DEBIAN-CVE-2025-40928
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-23657.5

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)

Record: OESA-2025-2365
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 22 moreShow less

OSVOESA-2025-23667.5

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)

Record: OESA-2025-2366
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-23677.5

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)

Record: OESA-2025-2367
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-24477.5

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)

Record: OESA-2025-2447
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-24487.5

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)

Record: OESA-2025-2448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-24497.5

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)

Record: OESA-2025-2449
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:171197.5

Red Hat Security Advisory: perl-JSON-XS security update

Record: RHSA-2025:17119
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:171627.5

Red Hat Security Advisory: perl-JSON-XS security update

Record: RHSA-2025:17162
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:171637.5

Red Hat Security Advisory: perl-JSON-XS security update

Record: RHSA-2025:17163
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:174307.5

Red Hat Security Advisory: perl-JSON-XS security update

Record: RHSA-2025:17430
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2025:171197.5

Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:17119
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2025:171627.5

Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:17162
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2025:171637.5

Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2025:17163
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-409287.5

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: UBUNTU-CVE-2025-40928
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2025:17119No score

Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:17119
Updated: 2026-11-02

OSVALSA-2025:17162No score

Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:17162
Updated: 2026-11-02

OSVALSA-2025:17163No score

Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2025:17163
Updated: 2026-11-02

OSVAZL-67076No score

CVE-2025-40928 affecting package perl-JSON-XS for versions less than 4.04-1

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: AZL-67076
Updated: 2026-11-02

OSVAZL-67079No score

CVE-2025-40928 affecting package perl-JSON-XS for versions less than 4.04-1

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: AZL-67079
Updated: 2026-11-02

OSVNo score

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Record: CVE-2025-40928
Updated: 2026-11-02

OSVMGASA-2025-0283No score

Updated perl-JSON-XS packages fix security vulnerability

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact. (CVE-2025-40928)

Record: MGASA-2025-0283
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15535-1No score

perl-JSON-XS-4.40.0-1.1 on GA media

These are all security issues fixed in the perl-JSON-XS-4.40.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15535-1
Updated: 2026-11-02

OSVUSN-7750-1No score

libjson-xs-perl vulnerability

It was discovered that JSON-XS incorrectly handled parsing certain JSON data. An attacker could possibly use this issue to cause JSON-XS to crash, resulting in a denial of service.

Record: USN-7750-1
Updated: 2026-11-02

Affected products

mlehmann json::xs

Affected packages

Affected packages
Package	Affected	Fixed
`perl-JSON-XS` AlmaLinux:10	before 1:4.04-1.el10_0	1:4.04-1.el10_0
`perl-JSON-XS` AlmaLinux:9	before 1:4.04-1.el9_6	1:4.04-1.el9_6
`perl-JSON-XS` AlmaLinux:8	before 1:3.04-4.el8_10	1:3.04-4.el8_10
`perl-JSON-XS` Azure Linux:3	before 4.04-1	4.04-1
`perl-JSON-XS` Azure Linux:2	before 4.04-1	4.04-1
`libjson-xs-perl` Debian:12	before 4.040-1~deb12u1, plus listed versions 4.030-24.030-3	4.040-1~deb12u1
`libjson-xs-perl` Debian:13	before 4.040-1~deb13u1, plus listed versions 4.030-24.030-34.040-1~deb12u1	4.040-1~deb13u1
`libjson-xs-perl` Debian:14	before 4.030-3, plus listed versions 4.030-2	4.030-3
`libjson-xs-perl` Debian:11	before 4.030-1+deb11u1, plus listed versions 4.030-1	4.030-1+deb11u1
`perl-JSON-XS` Mageia:9	before 4.30.0-5.1.mga9	4.30.0-5.1.mga9

Show 31 moreShow less

Affected packages
Package	Affected	Fixed
`perl-JSON-XS` openEuler:20.03-LTS-SP4	before 3.04-7.oe2003sp4	3.04-7.oe2003sp4
`perl-JSON-XS` openEuler:24.03-LTS	before 4.03-2.oe2403	4.03-2.oe2403
`perl-JSON-XS` openEuler:24.03-LTS-SP2	before 4.03-2.oe2403sp2	4.03-2.oe2403sp2
`perl-JSON-XS` openEuler:22.03-LTS-SP4	before 4.03-2.oe2203sp4	4.03-2.oe2203sp4
`perl-JSON-XS` openEuler:24.03-LTS-SP1	before 4.03-2.oe2403sp1	4.03-2.oe2403sp1
`perl-JSON-XS` openEuler:22.03-LTS-SP3	before 4.03-2.oe2203sp3	4.03-2.oe2203sp3
`perl-JSON-XS` Red Hat:enterprise_linux:10.0	before 1:4.04-1.el10_0	1:4.04-1.el10_0
`perl-JSON-XS-debuginfo` Red Hat:enterprise_linux:10.0	before 1:4.04-1.el10_0	1:4.04-1.el10_0
`perl-JSON-XS-debugsource` Red Hat:enterprise_linux:10.0	before 1:4.04-1.el10_0	1:4.04-1.el10_0
`perl-JSON-XS` Red Hat:enterprise_linux:9::crb	before 1:4.04-1.el9_6	1:4.04-1.el9_6
`perl-JSON-XS-debuginfo` Red Hat:enterprise_linux:9::crb	before 1:4.04-1.el9_6	1:4.04-1.el9_6
`perl-JSON-XS-debugsource` Red Hat:enterprise_linux:9::crb	before 1:4.04-1.el9_6	1:4.04-1.el9_6
`perl-JSON-XS` Red Hat:enterprise_linux:8::crb	before 1:3.04-4.el8_10	1:3.04-4.el8_10
`perl-JSON-XS-debuginfo` Red Hat:enterprise_linux:8::crb	before 1:3.04-4.el8_10	1:3.04-4.el8_10
`perl-JSON-XS-debugsource` Red Hat:enterprise_linux:8::crb	before 1:3.04-4.el8_10	1:3.04-4.el8_10
`perl-JSON-XS` Red Hat:rhel_eus:9.4::crb	before 1:4.03-5.el9_4.1	1:4.03-5.el9_4.1
`perl-JSON-XS-debuginfo` Red Hat:rhel_eus:9.4::crb	before 1:4.03-5.el9_4.1	1:4.03-5.el9_4.1
`perl-JSON-XS-debugsource` Red Hat:rhel_eus:9.4::crb	before 1:4.03-5.el9_4.1	1:4.03-5.el9_4.1
`perl-JSON-XS` Rocky Linux:10	before 1:4.04-1.el10_0	1:4.04-1.el10_0
`perl-JSON-XS` Rocky Linux:9	before 1:4.04-1.el9_6	1:4.04-1.el9_6
`perl-JSON-XS` Rocky Linux:8	before 1:3.04-4.el8_10	1:3.04-4.el8_10
`libjson-xs-perl` Ubuntu:14.04:LTS	All versions, plus listed versions 2.340-12.340-1build1	None known
`libjson-xs-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 3.010-23.010-2build1	None known
`libjson-xs-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 3.030-1build13.040-1	None known
`libjson-xs-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 4.020-14.020-1build1	None known
`libjson-xs-perl` Ubuntu:22.04:LTS	before 4.040-0ubuntu0.22.04.1, plus listed versions 4.030-1build24.030-1build3	4.040-0ubuntu0.22.04.1
`libjson-xs-perl` Ubuntu:24.04:LTS	before 4.040-0ubuntu0.24.04.1, plus listed versions 4.030-24.030-2build14.030-2build24.030-2build3	4.040-0ubuntu0.24.04.1
`libjson-xs-perl` Ubuntu:25.10	before 4.040-1, plus listed versions 4.030-2build4	4.040-1
`libjson-xs-perl` Ubuntu:26.10	before 4.040-1	4.040-1
`libjson-xs-perl` Ubuntu:26.04:LTS	before 4.040-1	4.040-1
`perl-JSON-XS` openSUSE:Tumbleweed	before 4.40.0-1.1	4.40.0-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-40928 is a high vulnerability (CVSS 7.5) in Mlehmann Json::xs, published September 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in perl-JSON-XS 1:4.04-1.el10_0.

References

Show 32 moreShow less