diff --git a/.gitignore b/.gitignore
index cd32eab..82dc76f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@ JSON-XS-2.27.tar.gz
 /JSON-XS-4.01.tar.gz
 /JSON-XS-4.02.tar.gz
 /JSON-XS-4.03.tar.gz
+/JSON-XS-4.04.tar.gz
diff --git a/perl-JSON-XS.spec b/perl-JSON-XS.spec
index 89b0515..05e0e3d 100644
--- a/perl-JSON-XS.spec
+++ b/perl-JSON-XS.spec
@@ -1,8 +1,8 @@
 Name:           perl-JSON-XS
 Summary:        JSON serializing/de-serializing, done correctly and fast
 Epoch:          1
-Version:        4.03
-Release:        5%{?dist}
+Version:        4.04
+Release:        1%{?dist}
 License:        GPL+ or Artistic
 URL:            https://metacpan.org/release/JSON-XS
 Source0:        https://cpan.metacpan.org/modules/by-module/JSON/JSON-XS-%{version}.tar.gz
@@ -101,6 +101,10 @@ make test
 %{_libexecdir}/%{name}
 
 %changelog
+* Mon Sep 15 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1:4.04-1
+- Update to 4.04
+- Fix CVE-2025-40928
+
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1:4.03-5
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
   Related: rhbz#1991688
diff --git a/sources b/sources
index 0bf89bd..f698b4b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (JSON-XS-4.03.tar.gz) = 7d2c20302b0f98bd69e692b61d272b58c13a79741f3e2e44ee0530e21dd239526477f8b02e4afbfe41ee83cb69ab1c5247bf0be355f3f09e9cfe31b2ea4a5155
+SHA512 (JSON-XS-4.04.tar.gz) = 018d02c7db58a8469afd8454c7822602a50d09a1658e41511ae38bc0f0cfe88f180758ae1dc0f1a933869c8e5c1e7535a2e4d312a9d206544df0ccb4cba11295