Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03193-1 advisory.

    - CVE-2025-40929: integer buffer overflow causing a segmentation fault when parsing crafted JSON     (bsc#1249331).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ce67f2ffd1 advisory.

    This update fixes an issue where a specially-crafted JSON input could cause an integer overflow leading to     a crash in the program parsing the JSON (CVE-2025-40929).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6000 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6000-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 11, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libcpanel-json-xs-perl     CVE ID         : CVE-2025-40929

    Michael Hudak discovered a flaw in libcpanel-json-xs-perl, a module for     fast and correct serialising to JSON. An integer buffer overflow causing     a segfault when parsing specially crafted JSON, may allow an attacker to     mount a denial-of-service attack or cause other unspecified impact.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 4.35-1+deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 4.39-2~deb13u1.

    We recommend that you upgrade your libcpanel-json-xs-perl packages.

    For the detailed security status of libcpanel-json-xs-perl please refer     to its security tracker page at:
    https://security-tracker.debian.org/tracker/libcpanel-json-xs-perl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when     parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact (CVE-2025-40929)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
264678	SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2025:03193-1)	Nessus	SuSE Local Security Checks	medium
264650	Fedora 43 : perl-Cpanel-JSON-XS (2025-ce67f2ffd1)	Nessus	Fedora Local Security Checks	medium
264576	Debian dsa-6000 : libcpanel-json-xs-perl - security update	Nessus	Debian Local Security Checks	medium
264355	Linux Distros Unpatched Vulnerability : CVE-2025-40929	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-40929

medium

Tenable Plugins

medium

medium

medium

medium