Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4318 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4318-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Paride Legovini     September 30, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libcpanel-json-xs-perl     Version        : 4.25-1+deb11u1     CVE ID         : CVE-2025-40929

    A vulnerability has been fixed in libcpanel-json-xs-perl, a Perl module     for serialising to JSON.

    CVE-2025-40929

        Integer buffer overflow causing a segfault when parsing crafted JSON,         enabling denial-of-service attacks or other unspecified impact

    For Debian 11 bullseye, this problem has been fixed in version     4.25-1+deb11u1.

    We recommend that you upgrade your libcpanel-json-xs-perl packages.

    For the detailed security status of libcpanel-json-xs-perl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libcpanel-json-xs-perl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1199 advisory.

    Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when     parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact (CVE-2025-40929)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f4f4dae8f2 advisory.

    This update fixes an issue where a specially-crafted JSON input could cause an integer overflow leading to     a crash in the program parsing the JSON (CVE-2025-40929).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-89495f6403 advisory.

    This update fixes an issue where a specially-crafted JSON input could cause an integer overflow leading to     a crash in the program parsing the JSON (CVE-2025-40929).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has a package installed that is affected by a vulnerability as referenced in the USN-7749-1 advisory.

    It was discovered that Cpanel-JSON-XS incorrectly handled parsing certain JSON data. An attacker could     possibly use this issue to cause Cpanel-JSON-XS to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:03193-1 advisory.

    - CVE-2025-40929: integer buffer overflow causing a segmentation fault when parsing crafted JSON     (bsc#1249331).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ce67f2ffd1 advisory.

    This update fixes an issue where a specially-crafted JSON input could cause an integer overflow leading to     a crash in the program parsing the JSON (CVE-2025-40929).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6000 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6000-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 11, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libcpanel-json-xs-perl     CVE ID         : CVE-2025-40929

    Michael Hudak discovered a flaw in libcpanel-json-xs-perl, a module for     fast and correct serialising to JSON. An integer buffer overflow causing     a segfault when parsing specially crafted JSON, may allow an attacker to     mount a denial-of-service attack or cause other unspecified impact.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 4.35-1+deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 4.39-2~deb13u1.

    We recommend that you upgrade your libcpanel-json-xs-perl packages.

    For the detailed security status of libcpanel-json-xs-perl please refer     to its security tracker page at:
    https://security-tracker.debian.org/tracker/libcpanel-json-xs-perl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when     parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact (CVE-2025-40929)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
266337	Debian dla-4318 : libcpanel-json-xs-perl - security update	Nessus	Debian Local Security Checks	medium
266168	Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2025-1199)	Nessus	Amazon Linux Local Security Checks	medium
265387	Fedora 42 : perl-Cpanel-JSON-XS (2025-f4f4dae8f2)	Nessus	Fedora Local Security Checks	medium
265383	Fedora 41 : perl-Cpanel-JSON-XS (2025-89495f6403)	Nessus	Fedora Local Security Checks	medium
265090	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : Cpanel-JSON-XS vulnerability (USN-7749-1)	Nessus	Ubuntu Local Security Checks	medium
264678	SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2025:03193-1)	Nessus	SuSE Local Security Checks	medium
264650	Fedora 43 : perl-Cpanel-JSON-XS (2025-ce67f2ffd1)	Nessus	Fedora Local Security Checks	medium
264576	Debian dsa-6000 : libcpanel-json-xs-perl - security update	Nessus	Debian Local Security Checks	medium
264355	Linux Distros Unpatched Vulnerability : CVE-2025-40929	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-40929

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium