The perl-JSON-XS module, which converts Perl data structures to JSON and vice versa and is implemented in C for performance, contains an integer buffer overflow vulnerability (CVE-2025-40928). This flaw causes a segmentation fault when parsing specially crafted JSON input. Red Hat has issued a security advisory (RHSA-2025:17430) describing this moderate severity issue and providing updated packages for Red Hat Enterprise Linux 9.4 Extended Update Support on x86_64, ppc64le, s390x, and aarch64 architectures. The advisory references the CVE and directs users to apply the update to mitigate the risk.

The vulnerability causes an integer buffer overflow leading to a segmentation fault, which results in a denial of service condition by crashing the affected application when processing malicious JSON input. No known exploits in the wild have been reported. The impact is limited to application stability and does not explicitly mention code execution or data corruption.

Red Hat has released updated perl-JSON-XS packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix this vulnerability. Users should apply these official updates as described in Red Hat advisory RHSA-2025:17430 and the linked article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.