CVE-2025-40928: JSON::XS Perl DoS Vulnerability

CVE-2025-40928 Overview

CVE-2025-40928 is a critical integer buffer overflow vulnerability affecting JSON::XS, a popular high-performance JSON parsing library for Perl. Versions prior to 4.04 contain a flaw that allows attackers to trigger a segmentation fault by supplying specially crafted JSON input. This vulnerability can be exploited to cause denial-of-service conditions and may potentially enable other unspecified impacts depending on the application context.

Critical Impact

Attackers can crash applications using vulnerable JSON::XS versions by sending malicious JSON payloads, disrupting service availability for web applications, APIs, and backend systems that rely on Perl-based JSON processing.

Affected Products

• JSON::XS versions before 4.04
• Perl applications utilizing vulnerable JSON::XS versions
• Debian systems with unpatched JSON::XS packages

Discovery Timeline

• 2025-09-08 - CVE-2025-40928 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40928

Vulnerability Analysis

This vulnerability stems from an integer buffer overflow condition within the JSON::XS XS.xs source code, specifically around line 256 as referenced in the MetaCPAN Source Code Reference. The flaw is classified under CWE-122 (Heap-based Buffer Overflow), indicating that improper bounds checking during JSON parsing operations can lead to memory corruption.

When JSON::XS processes certain malformed or excessively crafted JSON structures, an integer overflow occurs during buffer size calculations. This causes the library to allocate an insufficient buffer, and subsequent write operations overflow the allocated heap memory region. The resulting memory corruption triggers a segmentation fault, immediately crashing the affected process.

The vulnerability is exploitable over the network without authentication or user interaction, making it particularly dangerous for internet-facing services that parse untrusted JSON input.

Root Cause

The root cause is an integer overflow in the buffer size calculation logic within the XS.xs parsing code. When processing specially crafted JSON input with specific size characteristics, the integer arithmetic used to compute required buffer sizes wraps around, resulting in a smaller-than-expected allocation. Subsequent parsing operations write beyond the allocated buffer boundaries, corrupting adjacent heap memory and causing a segmentation fault.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by sending a crafted JSON payload to any application endpoint that processes JSON using vulnerable JSON::XS versions. The attack is particularly effective against:

• Web applications accepting JSON API requests
• Backend services parsing JSON configuration or data
• Message queue consumers processing JSON messages
• Any Perl script or daemon that deserializes untrusted JSON input

The vulnerability triggers when the parser encounters the malicious input, causing immediate process termination. For technical details on the vulnerable code path, refer to the MetaCPAN Source Code Reference.

Detection Methods for CVE-2025-40928

Indicators of Compromise

• Unexpected segmentation faults or crashes in Perl processes handling JSON data
• Core dump files generated by applications using JSON::XS during JSON parsing operations
• Service availability issues correlated with receipt of unusual JSON payloads
• Error logs showing memory-related crashes in JSON parsing routines

Detection Strategies

• Monitor application logs for segmentation fault signals (SIGSEGV) in Perl processes
• Implement JSON payload size and structure validation at ingress points before processing
• Deploy endpoint protection solutions like SentinelOne that detect memory corruption exploitation attempts
• Audit installed Perl module versions to identify JSON::XS versions below 4.04

Monitoring Recommendations

• Enable core dump analysis for production Perl applications to capture crash details
• Configure application performance monitoring to alert on unexpected process restarts
• Implement request logging with payload metadata to correlate crashes with specific inputs
• Use SentinelOne Singularity platform for real-time behavioral detection of exploitation attempts

How to Mitigate CVE-2025-40928

Immediate Actions Required

• Upgrade JSON::XS to version 4.04 or later immediately across all affected systems
• Apply the available patch from MetaCPAN CVE-2025 Patch if immediate upgrade is not possible
• Implement input validation to reject excessively large or malformed JSON before processing
• Consider temporary use of alternative JSON parsing libraries like JSON::PP until patching is complete
• Review the Debian LTS Announcement for distribution-specific guidance

Patch Information

The vulnerability has been addressed in JSON::XS version 4.04. A backport patch is available for version 4.03 at the MetaCPAN CVE-2025 Patch repository. Debian users should apply updates from their distribution's security repositories as detailed in the Debian LTS Announcement. The security discussion and additional context can be found in the Openwall OSS-Security Discussion.

Workarounds

• Implement a reverse proxy or web application firewall to validate and sanitize JSON input before it reaches Perl applications
• Add application-level JSON size limits to prevent processing of excessively large payloads
• Deploy rate limiting on endpoints accepting JSON to reduce exploitation impact
• Consider containerization with resource limits to contain crash impact and enable automatic recovery

# Upgrade JSON::XS using CPAN
cpan JSON::XS

# Verify installed version is 4.04 or later
perl -MJSON::XS -e 'print $JSON::XS::VERSION . "\n"'

# For Debian-based systems, update via package manager
apt-get update && apt-get install libjson-xs-perl