{"id":"CVE-2025-40928","aliases":["ALSA-2025:17119","ALSA-2025:17162","ALSA-2025:17163","AZL-67076","AZL-67079","DEBIAN-CVE-2025-40928","DLA-4317-1","DSA-5999-1","EUVD-2025-27141","GHSA-v8qr-gpx9-78rm","MGASA-2025-0283","OESA-2025-2365","OESA-2025-2366","OESA-2025-2367","OESA-2025-2447","OESA-2025-2448","OESA-2025-2449","RHSA-2025:17119","RHSA-2025:17162","RHSA-2025:17163","RHSA-2025:17430","RLSA-2025:17119","RLSA-2025:17162","RLSA-2025:17163","UBUNTU-CVE-2025-40928","USN-7750-1","openSUSE-SU-2025:15535-1"],"status":"published","title":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.007,"percentile":0.5366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2025-09-08T15:08:21Z","modified":"2026-10-29T11:58:12Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"perl-JSON-XS","fixed_in":["1:4.04-1.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"perl-JSON-XS","fixed_in":["1:4.04-1.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-JSON-XS","fixed_in":["1:3.04-4.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl-JSON-XS","fixed_in":["4.04-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"perl-JSON-XS","fixed_in":["4.04-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libjson-xs-perl","fixed_in":["4.040-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libjson-xs-perl","fixed_in":["4.040-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjson-xs-perl","fixed_in":["4.030-3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libjson-xs-perl","fixed_in":["4.030-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-JSON-XS","fixed_in":["4.30.0-5.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-JSON-XS","fixed_in":["3.04-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"perl-JSON-XS","fixed_in":["4.03-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"perl-JSON-XS","fixed_in":["4.03-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-JSON-XS","fixed_in":["4.03-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-JSON-XS","fixed_in":["4.03-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"perl-JSON-XS","fixed_in":["4.03-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-JSON-XS","fixed_in":["1:4.04-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-JSON-XS-debuginfo","fixed_in":["1:4.04-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-JSON-XS-debugsource","fixed_in":["1:4.04-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-JSON-XS","fixed_in":["1:4.04-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-JSON-XS-debuginfo","fixed_in":["1:4.04-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-JSON-XS-debugsource","fixed_in":["1:4.04-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-JSON-XS","fixed_in":["1:3.04-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-JSON-XS-debuginfo","fixed_in":["1:3.04-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-JSON-XS-debugsource","fixed_in":["1:3.04-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-JSON-XS","fixed_in":["1:4.03-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-JSON-XS-debuginfo","fixed_in":["1:4.03-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-JSON-XS-debugsource","fixed_in":["1:4.03-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"perl-JSON-XS","fixed_in":["1:4.04-1.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-JSON-XS","fixed_in":["1:4.04-1.el9_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-JSON-XS","fixed_in":["1:3.04-4.el8_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libjson-xs-perl","fixed_in":["4.040-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libjson-xs-perl","fixed_in":["4.040-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libjson-xs-perl","fixed_in":["4.040-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"libjson-xs-perl","fixed_in":["4.040-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libjson-xs-perl","fixed_in":["4.040-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-JSON-XS","fixed_in":["4.40.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.04-4.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1~deb12u1"}]}],"versions":["4.030-2","4.030-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1~deb13u1"}]}],"versions":["4.030-2","4.030-3","4.040-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.030-3"}]}],"versions":["4.030-2"]},{"source":"osv","ecosystem":"Debian:11","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.030-1+deb11u1"}]}],"versions":["4.030-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1~deb12u1"}]}],"versions":["4.030-2","4.030-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1~deb13u1"}]}],"versions":["4.030-2","4.030-3","4.040-1~deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30.0-5.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.04-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-JSON-XS-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-JSON-XS-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-JSON-XS-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-JSON-XS-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.04-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-JSON-XS-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.04-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"perl-JSON-XS-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.04-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.03-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-JSON-XS-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.03-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"perl-JSON-XS-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.03-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.04-1.el9_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.04-4.el8_10"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.340-1","2.340-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.010-2","3.010-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.030-1build1","3.040-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.020-1","4.020-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-0ubuntu0.22.04.1"}]}],"versions":["4.030-1build2","4.030-1build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-0ubuntu0.24.04.1"}]}],"versions":["4.030-2","4.030-2build1","4.030-2build2","4.030-2build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1"}]}],"versions":["4.030-2build4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-0ubuntu0.22.04.1"}]}],"versions":["4.030-1build2","4.030-1build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libjson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.040-0ubuntu0.24.04.1"}]}],"versions":["4.030-2","4.030-2build1","4.030-2build2","4.030-2build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.40.0-1.1"}]}]}],"products":[{"vendor":"mlehmann","product":"json::xs"}],"references":[{"url":"https://metacpan.org/release/MLEHMANN/JSON-XS-4.03/source/XS.xs#L256","tags":["related","web","article","report"]},{"url":"https://security.metacpan.org/patches/J/JSON-XS/4.03/CVE-2025-40928-r1.patch","tags":["patch","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00033.html"},{"url":"http://www.openwall.com/lists/oss-security/2025/09/08/2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40928","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v8qr-gpx9-78rm"},{"url":"https://access.redhat.com/errata/RHSA-2025:17119","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-40928","tags":["report"]},{"url":"https://bugzilla.redhat.com/2393878","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-17119.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17162","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-17162.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17163","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-17163.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40928","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0283.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34628","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/09/08/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2365","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2366","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2367","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2447","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2448","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2449","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393878","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17119.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40928","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17162.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17163.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:17430","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17430.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:17119","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:17162","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:17163","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40928","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/32608909/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7750-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40928","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-40928","title":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:08:21.86Z","modified":"2025-11-04T21:10:22.058Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-27141","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:08:21Z","modified":"2025-11-04T21:10:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-v8qr-gpx9-78rm","title":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when...","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:37:45Z","modified":"2025-11-05T00:31:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-40928","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:15:35.81Z","modified":"2026-06-17T09:22:18.667Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:11:27.73916Z"}],"osv":[{"id":"DEBIAN-CVE-2025-40928","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:15:35.81Z","modified":"2026-09-01T20:05:52.643001682Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"OESA-2025-2365","title":"perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\r\n\r\nSecurity Fix(es):\n\nJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)","status":"published","published":"2025-10-11T11:09:26Z","modified":"2026-08-18T01:19:12.59727119Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2366","title":"perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\r\n\r\nSecurity Fix(es):\n\nJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)","status":"published","published":"2025-10-11T11:09:26Z","modified":"2026-08-18T01:19:11.634379545Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2367","title":"perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\r\n\r\nSecurity Fix(es):\n\nJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)","status":"published","published":"2025-10-11T11:09:26Z","modified":"2026-08-18T01:19:12.259771184Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2447","title":"perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\r\n\r\nSecurity Fix(es):\n\nJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:14.280990316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2448","title":"perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\r\n\r\nSecurity Fix(es):\n\nJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:13.998778872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2449","title":"perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\r\n\r\nSecurity Fix(es):\n\nJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact(CVE-2025-40928)","status":"published","published":"2025-10-17T11:09:32Z","modified":"2026-08-18T01:19:13.706937239Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:17119","title":"Red Hat Security Advisory: perl-JSON-XS security update","status":"published","published":"2025-10-01T10:13:26Z","modified":"2026-06-30T10:19:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17162","title":"Red Hat Security Advisory: perl-JSON-XS security update","status":"published","published":"2025-10-02T10:07:51Z","modified":"2026-06-30T10:19:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17163","title":"Red Hat Security Advisory: perl-JSON-XS security update","status":"published","published":"2025-10-02T10:07:52Z","modified":"2026-06-30T10:19:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:17430","title":"Red Hat Security Advisory: perl-JSON-XS security update","status":"published","published":"2025-10-08T10:04:30Z","modified":"2026-06-30T10:19:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RLSA-2025:17119","title":"Moderate: perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\n\nSecurity Fix(es):\n\n* JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-07T17:26:06.117599Z","modified":"2025-10-08T17:12:51.671309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:17162","title":"Moderate: perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\n\nSecurity Fix(es):\n\n* JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-10T05:50:59.371707Z","modified":"2025-10-10T06:32:23.970821Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:17163","title":"Moderate: perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.\n\nSecurity Fix(es):\n\n* JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:29:14.627135Z","modified":"2025-10-08T18:43:09.037877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-40928","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:15:00Z","modified":"2026-10-17T12:56:51.333307623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:46.53147Z"},{"id":"ALSA-2025:17119","title":"Moderate: perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.  \n\nSecurity Fix(es):  \n\n  * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-09-30T00:00:00Z","modified":"2026-10-29T11:58:12.929198Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:17162","title":"Moderate: perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.  \n\nSecurity Fix(es):  \n\n  * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-10-29T11:32:28.391067851Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:17163","title":"Moderate: perl-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.  \n\nSecurity Fix(es):  \n\n  * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-10-29T11:02:22.426034259Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-67076","title":"CVE-2025-40928 affecting package perl-JSON-XS for versions less than 4.04-1","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:15:35Z","modified":"2026-04-21T04:47:25.74748Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-67079","title":"CVE-2025-40928 affecting package perl-JSON-XS for versions less than 4.04-1","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:15:35Z","modified":"2026-04-21T04:38:03.978738Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"CVE-2025-40928","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact","status":"published","published":"2025-09-08T15:15:35Z","modified":"2026-04-16T04:37:42.818067907Z","updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DLA-4317-1","title":"libjson-xs-perl - security update","status":"published","published":"2025-09-30T00:00:00Z","modified":"2025-09-30T21:32:14.435686Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5999-1","title":"libjson-xs-perl - security update","status":"published","published":"2025-09-11T00:00:00Z","modified":"2026-03-09T02:09:26.566137Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0283","title":"Updated perl-JSON-XS packages fix security vulnerability","description":"JSON::XS before version 4.04 for Perl has an integer buffer overflow\ncausing a segfault when parsing crafted JSON, enabling denial-of-service\nattacks or other unspecified impact. (CVE-2025-40928)\n","status":"published","published":"2025-11-13T18:03:54Z","modified":"2026-04-16T04:41:53.174461372Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15535-1","title":"perl-JSON-XS-4.40.0-1.1 on GA media","description":"These are all security issues fixed in the perl-JSON-XS-4.40.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-09T00:00:00Z","modified":"2026-03-23T04:53:54.747143Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"USN-7750-1","title":"libjson-xs-perl vulnerability","description":"It was discovered that JSON-XS incorrectly handled parsing certain JSON\ndata. An attacker could possibly use this issue to cause JSON-XS to crash,\nresulting in a denial of service.","status":"published","published":"2025-09-15T14:30:37Z","modified":"2026-04-27T18:17:06.520153Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}