diff --git a/Source/cmPackageInfoReader.cxx b/Source/cmPackageInfoReader.cxx
index 25d6b6b6f3..06c61a13d8 100644
--- a/Source/cmPackageInfoReader.cxx
+++ b/Source/cmPackageInfoReader.cxx
@@ -15,6 +15,7 @@
 #include <cm3p/json/version.h>
 
 #include "cmsys/RegularExpression.hxx"
+#include "cmsys/String.h"
 
 #include "cmCxxModuleMetadata.h"
 #include "cmExecutionStatus.h"
@@ -437,11 +438,10 @@ cm::optional<cmPackageInfoReader::Pep440Version> ParseSimpleVersion(
     }
 
     // Extract the part as a number.
-    cm::string_view const part = remnant.substr(0, n);
-    std::string::size_type const l = part.size();
-    std::string::size_type p;
-    unsigned long const value = std::stoul(std::string{ part }, &p);
-    if (p != l || value > std::numeric_limits<unsigned>::max()) {
+    unsigned long value;
+    std::string const part = std::string{ remnant.substr(0, n) };
+    if (!cmsysString_isdigit(part[0]) || !cmStrToULong(part, &value) ||
+        value > std::numeric_limits<unsigned>::max()) {
       // The part was not a valid number or is too big.
       return cm::nullopt;
     }
diff --git a/Tests/RunCMake/find_package-CPS/InvalidVersion.cmake b/Tests/RunCMake/find_package-CPS/InvalidVersion.cmake
new file mode 100644
index 0000000000..db15dffd55
--- /dev/null
+++ b/Tests/RunCMake/find_package-CPS/InvalidVersion.cmake
@@ -0,0 +1,14 @@
+cmake_minimum_required(VERSION 4.0)
+
+include(Setup.cmake)
+
+set(CMAKE_FIND_PACKAGE_SORT_ORDER NAME)
+set(CMAKE_FIND_PACKAGE_SORT_DIRECTION ASC)
+
+###############################################################################
+# Test that malformed versions are rejected (rather than crashing).
+find_package(InvalidVersion 1.0 QUIET)
+if(InvalidVersion_FOUND)
+  message(SEND_ERROR "InvalidVersion unexpectedly found with version "
+                     "\"${InvalidVersion_VERSION}\" !")
+endif()
diff --git a/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake b/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake
index 291bd928bb..cd4598fb96 100644
--- a/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake
+++ b/Tests/RunCMake/find_package-CPS/RunCMakeTest.cmake
@@ -37,6 +37,7 @@ run_cmake(VersionLimit1)
 run_cmake(VersionLimit2)
 run_cmake(TransitiveVersion)
 run_cmake(CustomVersion)
+run_cmake(InvalidVersion)
 
 # Metadata Tests
 run_cmake(License)
diff --git a/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/1/InvalidVersion.cps b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/1/InvalidVersion.cps
new file mode 100644
index 0000000000..0aad3f00e1
--- /dev/null
+++ b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/1/InvalidVersion.cps
@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": " ",
+  "cps_path": "@prefix@/cps/InvalidVersion/1",
+  "components": {}
+}
diff --git a/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/2/InvalidVersion.cps b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/2/InvalidVersion.cps
new file mode 100644
index 0000000000..6c6eaa3e24
--- /dev/null
+++ b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/2/InvalidVersion.cps
@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": " 1",
+  "cps_path": "@prefix@/cps/InvalidVersion/2",
+  "components": {}
+}
diff --git a/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/3/InvalidVersion.cps b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/3/InvalidVersion.cps
new file mode 100644
index 0000000000..575d594b2e
--- /dev/null
+++ b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/3/InvalidVersion.cps
@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": "1 ",
+  "cps_path": "@prefix@/cps/InvalidVersion/3",
+  "components": {}
+}
diff --git a/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/4/InvalidVersion.cps b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/4/InvalidVersion.cps
new file mode 100644
index 0000000000..26866b0fb4
--- /dev/null
+++ b/Tests/RunCMake/find_package-CPS/cps/InvalidVersion/4/InvalidVersion.cps
@@ -0,0 +1,7 @@
+{
+  "cps_version": "0.13",
+  "name": "InvalidVersion",
+  "version": "99999999999999999999",
+  "cps_path": "@prefix@/cps/InvalidVersion/4",
+  "components": {}
+}