CVE Feed

    Dashboard / CVE / CVE-2025-40907

    CVE-2025-40907

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

    Published:May 16, 2025
    Last Modified:Sep 29, 2025
    EPS:May 16, 2025
    EPSS Score:0.00144
    CVSS Score:5.3

    Affected Products

    Vendor
    Fastcgi
    Product
    Fcgi
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Els
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Tus

    Exploits

    https://github.com/FastCGI-Archives/fcgi2/issues/67https://github.com/perl-catalyst/FCGI/issues/14https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High