CVE-2025-40929 - Vulnerability Details - OpenCVE

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes

History

Mon, 08 Sep 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 08 Sep 2025 15:15:00 +0000

Type	Values Removed	Values Added
Description		Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact
Title		Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact
Weaknesses		CWE-122
References		https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713 https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2025-09-08T15:08:52.327Z

Updated: 2025-09-08T19:25:59.188Z

Reserved: 2025-04-16T09:05:34.363Z

Link: CVE-2025-40929

Vulnrichment

Updated: 2025-09-08T19:25:53.295Z

NVD

Status : Awaiting Analysis

Published: 2025-09-08T15:15:35.957

Modified: 2025-09-08T20:15:34.703

Link: CVE-2025-40929

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-40929", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2025-04-16T09:05:34.363Z", "datePublished": "2025-09-08T15:08:52.327Z", "dateUpdated": "2025-09-08T19:25:59.188Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Cpanel-JSON-XS", "product": "Cpanel::JSON::XS", "programFiles": ["XS.xs"], "repo": "https://github.com/rurban/Cpanel-JSON-XS", "vendor": "RURBAN", "versions": [{"lessThan": "4.40", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Michael Hudak of rasotec"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact<br>"}], "value": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-09-08T15:08:52.327Z"}, "references": [{"tags": ["related"], "url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes"}, {"tags": ["patch"], "url": "https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 4.40 or later, or apply the provided patch"}], "value": "Update to 4.40 or later, or apply the provided patch"}], "source": {"discovery": "UNKNOWN"}, "title": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-08T19:25:39.696505Z", "id": "CVE-2025-40929", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T19:25:59.188Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-40929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T19:25:39.696505Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T19:25:53.295Z"}}], "cna": {"title": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Michael Hudak of rasotec"}], "affected": [{"repo": "https://github.com/rurban/Cpanel-JSON-XS", "vendor": "RURBAN", "product": "Cpanel::JSON::XS", "versions": [{"status": "affected", "version": "0", "lessThan": "4.40", "versionType": "custom"}], "packageName": "Cpanel-JSON-XS", "programFiles": ["XS.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 4.40 or later, or apply the provided patch", "supportingMedia": [{"type": "text/html", "value": "Update to 4.40 or later, or apply the provided patch", "base64": false}]}], "references": [{"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713", "tags": ["related"]}, {"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes", "tags": ["release-notes"]}, {"url": "https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact", "supportingMedia": [{"type": "text/html", "value": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2025-09-08T15:08:52.327Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40929", "state": "PUBLISHED", "dateUpdated": "2025-09-08T19:25:59.188Z", "dateReserved": "2025-04-16T09:05:34.363Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2025-09-08T15:08:52.327Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.1"}