CVE-2025-40906

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities

State: Published
Severity: 9.8 Critical
Published: May 16, 2025
Updated: Sep 9, 2025
Reserved: Apr 16, 2025

Description

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.

Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755.

BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-1104 Use of Unmaintained Third Party Components
CWE-122 Heap-based Buffer Overflow
CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
BSON::XSMONGODB	0.8.4 and earlierAffected

References

https://lists.debian.org/debian-lts-announce/2025/05/msg00012.htmlmailing-list
https://www.mongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.