CVE catalog

CVE-2025-40914

CryptX vulnerabilities

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.54% · Oct 25, 2026

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcryptx-perlsid0.091-1fixed
Debianlibcryptx-perlforky0.091-1fixed
Debianlibcryptx-perltrixie0.085-1+deb13u1vulnerable
Debianlibcryptx-perlbookworm0.077-1vulnerable
Ubuntulibcryptx-perlnobleNot reportedvulnerable
Ubuntulibcryptx-perlnoble0.080-2ubuntu0.1~esm1fixed
Ubuntulibcryptx-perlpro0.078-1vulnerable
Ubuntulibcryptx-perlpro0.080-1vulnerable
Ubuntulibcryptx-perlpro0.080-2vulnerable
Ubuntulibcryptx-perlpro0.080-2build1vulnerable
Ubuntulibcryptx-perlpro0.080-2build2vulnerable
Ubuntulibcryptx-perlpro0.080-2build3vulnerable
Ubuntulibcryptx-perlpro0.080-2ubuntu0.1~esm1fixed
Opensuseperl-CryptXtumbleweed0.87.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcryptx-perlsourcesid0.087-1not yet assignedNot reported[1107697]
Debianlibcryptx-perlsourceforky0.087-1not yet assignedNot reported[1107697]
Debianlibcryptx-perlsourcetrixie(unfixed)not yet assignedNot reported[1107697]
Debianlibcryptx-perlsourcebookworm(unfixed)not yet assignedNot reported[1107697]
Ubuntulibcryptx-perldebnoble0.080-2ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibcryptx-perldebpro0.080-2ubuntu0.1~esm1Not reportedUBUNTU-CVE-2025-40914Not reported
Opensuseperl-CryptXrpmtumbleweed0.87.0-1.1Not reportedOPENSUSE-SU-2025:15259-1Not reported

[Debian bug #1107697]

Notes

[trixie] libcryptx-perl: Minor issue [bookworm] libcryptx-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcryptx-perl]Affected

    Source package: [libcryptx-perl]

    Details (2)

    • 0.077-1+b1 · amd64 · bookworm

      Affected

      usn · libcryptx-perl · debian · bookworm; usn · libcryptx-perl · debian · 12

    • 0.077-1+b1 · arm64 · bookworm

      Affected

      usn · libcryptx-perl · debian · bookworm; usn · libcryptx-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcryptx-perl]Affected
    Details (4)

    • 0.085-1+deb13u1 · amd64 · trixie

      Affected

      usn · libcryptx-perl · debian · 13

    • 0.085-1+deb13u1 · arm64 · trixie

      Affected

      usn · libcryptx-perl · debian · 13

    • 0.090-1~bpo13+1 · amd64 · trixie-backports

      Affected

      usn · libcryptx-perl · debian · 13

    • 0.090-1~bpo13+1 · arm64 · trixie-backports

      Affected

      usn · libcryptx-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-CryptX]Fixed

    Source package: [perl-CryptX]

    Details (1)

    • 0.91.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 0.87.0-1.1

      usn · perl-CryptX · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]