Skip to content
OpenAdvisories
Medium ALAS2023-2025-1200 1 CVE

Moderate: perl-JSON-XS security update (Amazon Linux 2023)

Published Sep 17, 2025 · Updated Sep 29, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40928: JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 perl-JSON-XS 1:4.03-3.amzn2023.0.3
Amazon Linux · 2023 perl-JSON-XS-debuginfo 1:4.03-3.amzn2023.0.3
Amazon Linux · 2023 perl-JSON-XS-debugsource 1:4.03-3.amzn2023.0.3
Amazon Linux · 2023 perl-JSON-XS-tests 1:4.03-3.amzn2023.0.3

Vulnerabilities 1

  • High 7.5
    CVE-2025-40928

    JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

    JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

    MLEHMANN JSON::XS libjson-xs-perl perl-JSON-XS Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-40928.html