CVE-2025-40929: Cpanel::JSON::XS Buffer Overflow Vulnerability

CVE-2025-40929 Overview

CVE-2025-40929 is an integer buffer overflow vulnerability in Cpanel::JSON::XS before version 4.40, a widely used Perl module for JSON parsing. The flaw resides in the json_atof_scan1 numeric parsing routine within XS.xs. Attackers can trigger a segmentation fault by supplying crafted JSON input to any application that parses untrusted JSON with the affected module. The primary impact is denial of service, though the advisory notes other unspecified impact is possible. The vulnerability is classified under [CWE-122] Heap-based Buffer Overflow.

Critical Impact
Applications parsing attacker-controlled JSON with vulnerable versions of Cpanel::JSON::XS can crash on demand, disrupting web services, mail systems, and other Perl-based infrastructure.

Affected Products

Cpanel::JSON::XS Perl module versions prior to 4.40
Debian LTS distributions shipping the vulnerable Perl module
Downstream Perl applications and services that depend on Cpanel::JSON::XS for JSON parsing

Discovery Timeline

2025-09-08 - Vulnerability disclosed on the OpenWall oss-security mailing list
2025-09-08 - CVE-2025-40929 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40929

Vulnerability Analysis

The vulnerability exists in the json_atof_scan1 function of Cpanel::JSON::XS, defined in XS.xs. The function converts JSON numeric literals into floating-point values via a recursive digit-scanning routine. During digit extraction, the code computed (U8)*s - '0' on a signed character read from the input buffer. Non-digit bytes, including negative signed values from high-bit characters, produced integer wraparound that bypassed the digit range check dig >= 10. The parser then continued reading past the end of the numeric literal into adjacent heap memory, causing a segmentation fault on crafted JSON input.

Root Cause

The root cause is unsafe arithmetic on signed character values combined with an integer overflow in the loop guard. The original loop condition while (((U8)*s - '0') < 10) relied on unsigned wraparound to terminate scanning, but permitted misinterpretation of certain byte sequences. Improper cast ordering in U8 dig = (U8)*s - '0' further allowed the digit accumulator to advance past buffer boundaries.

Attack Vector

Exploitation requires the attacker to deliver crafted JSON to a service that decodes it with the vulnerable module. This is a network-reachable condition for any web API, RPC endpoint, or message consumer that accepts JSON payloads. Attack complexity is elevated because the malicious input must trigger the specific overflow path in the numeric parser.

text

   /* if we recurse too deep, skip all remaining digits */
   /* to avoid a stack overflow attack */
   if (UNLIKELY(--maxdepth <= 0))
-    while (((U8)*s - '0') < 10)
+    while (*s >= '0' && *s <= '9')
       ++s;
 
   for (;;)
     {
-      U8 dig = (U8)*s - '0';
+      U8 dig = (U8)(*s - '0');
 
       if (UNLIKELY(dig >= 10))
         {
-          if (dig == (U8)((U8)'.' - (U8)'0'))
+          if (dig == (U8)('.' - '0'))
             {
               ++s;
               json_atof_scan1 (s, accum, expo, 1, maxdepth);

Source: GitHub Commit Patch

The patch replaces the unsigned-wraparound digit test with explicit ASCII range comparisons and corrects the cast order in the digit extraction to prevent the overflow.

Detection Methods for CVE-2025-40929

Indicators of Compromise

Unexpected segmentation faults or SIGSEGV crashes in Perl processes that decode JSON payloads.
Repeated worker or fastcgi child restarts on services using Cpanel::JSON::XS shortly after receiving external JSON traffic.
Core dumps whose stack traces reference json_atof_scan1 or XS.xs.

Detection Strategies

Inventory Perl installations and enumerate installed Cpanel::JSON::XS versions using cpan -D Cpanel::JSON::XS or distribution package managers.
Correlate application crash logs with inbound requests containing large or malformed numeric JSON literals.
Deploy web application firewall rules that flag JSON payloads with abnormally long or malformed numeric tokens.

Monitoring Recommendations

Track process exit codes and crash telemetry across Perl-based web workers and background job runners.
Alert on spikes in HTTP 5xx responses tied to JSON API endpoints after receiving suspicious payloads.
Ingest system audit logs into a centralized SIEM to correlate SIGSEGV events with request identifiers and source addresses.

How to Mitigate CVE-2025-40929

Immediate Actions Required

Upgrade Cpanel::JSON::XS to version 4.40 or later on every host where the module is installed.
Apply the Debian LTS security update referenced in the Debian LTS Announcement for affected distributions.
Restart all long-running Perl services after upgrading to ensure the patched module is loaded into memory.

Patch Information

The fix is available in Cpanel::JSON::XS 4.40, published on CPAN. The upstream commit 378236219eaa35742c3962ecbdee364903b0a1f2 in the rurban/Cpanel-JSON-XS repository corrects the json_atof_scan1 overflow. Release notes are documented in the MetaCPAN Changes Log.

Workarounds

Restrict JSON parsing to trusted internal sources until the module can be upgraded.
Enforce strict input validation at the API gateway to reject JSON payloads containing malformed numeric literals or excessive digit sequences.
Fall back to an alternative JSON parser such as JSON::PP on hosts where upgrading Cpanel::JSON::XS is temporarily blocked.

bash

# Upgrade Cpanel::JSON::XS on Debian-based systems
sudo apt update
sudo apt install --only-upgrade libcpanel-json-xs-perl

# Verify installed module version
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION, "\n"'

# Or upgrade directly from CPAN
cpan Cpanel::JSON::XS