CVE-2025-40907

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

State: Published
Severity: 5.3 Medium
Published: May 16, 2025
Updated: Sep 5, 2025
Reserved: Apr 16, 2025

Description

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library.

The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	CISA-ADP

Weaknesses

CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-190 Integer Overflow or Wraparound
CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
FCGIETHER	0.44 through 0.82Affected

References

http://www.openwall.com/lists/oss-security/2025/04/23/4mailing-list
https://github.com/FastCGI-Archives/fcgi2/issues/67issue-tracking
https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.5patch
https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-librarytechnical-description
https://github.com/perl-catalyst/FCGI/issues/14issue-tracking
https://patch-diff.githubusercontent.com/raw/FastCGI-Archives/fcgi2/pull/74.patchpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.