CVE-2025-40907

CVE-2025-40907: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

Vendor Ether

Product FCGI

Weakness CWE-1395

Published May 16, 2025

Last update September 5, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Key dates

02Disclosure timeline

May 16, 2025 CVE published

September 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-40907 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1395.html

Related vulnerabilities

04Related CVE

CVE-2026-34654 Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) CVE-2025-42927 Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service) CVE-2023-5332 Dependency on Vulnerable Third-Party Component in GitLab CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled CVE-2025-40912 CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode