BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities

published 2025-05-16 last yr. modified 2026-06-17 4mo ago also EUVD-2025-15446

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.

Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755.

BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

Is CVE-2025-40906 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: last yr. (2025-05-17)

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

MONGODB BSON::XS

Classification

Weakness

CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-1104 Use of Unmaintained Third Party Components
CWE-122 Heap-based Buffer Overflow
CWE-190 Integer Overflow or Wraparound

References

mongodb.com /community/forums/t/mongodb-perl-driver-end-of-life/7890
vendor-advisory
lists.debian.org /debian-lts-announce/2025/05/msg00012.html
mailing-list

Sources

CVE List CVE-2025-40906
NVD CVE-2025-40906

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.