CVE-2025-40929: 
Linux Debian vulnerability analysis and mitigation

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact. The vulnerability was discovered by Michael Hudak of rasotec and was disclosed on September 8, 2025 (OSS-Security).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The issue occurs when parsing crafted JSON input that triggers an integer buffer overflow condition, which can lead to a segmentation fault. The vulnerability has been assigned a CVSS v3.1 base score of 5.6 MEDIUM (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (NVD).

The vulnerability can be exploited to cause denial-of-service conditions through application crashes. Additionally, there may be other unspecified impacts due to the buffer overflow condition. The vulnerability affects applications using Cpanel::JSON::XS versions prior to 4.40 (OSS-Security).

The recommended mitigation is to update to Cpanel::JSON::XS version 4.40 or later. Alternatively, users can apply the provided patch available at the official repository (CPAN-Patch).