CVE-2025-40907
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
Summary
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
Original description
The description as published by the source.
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library.
The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-40907 libfcgi-perl Fixed in: 0.79+ds-2
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch patch-diff.githubusercontent.com
- report github.com
- report github.com
- web cpan.org
- web openwall.com
- web synacktiv.com