Skip to content
Fencer Intel
medium 5.3

CVE-2025-40907 json

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

published last yr. modified 4mo ago also EUVD-2025-15438

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library.

The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Patch / fix

  • libfcgi-perl Debian 14, Debian 13, Debian 12 0.79+ds-2

debian advisories DEBIAN-CVE-2025-40907

  • libfcgi-perl Ubuntu 20.04 LTS 0.79-1ubuntu0.1
  • libfcgi-perl Ubuntu Pro 16.04 LTS 0.77-1ubuntu0.1~esm1
  • libfcgi-perl Ubuntu Pro 18.04 LTS 0.78-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-40907

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-FCGI RHEL 8 1:0.78-12.module+el8.10.0+23147+df114ff4
  • perl-FCGI RHEL 10.0 1:0.82-13.1.el10_0
  • perl-FCGI RHEL 9 1:0.79-8.1.el9_6
  • perl-FCGI RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 1:0.78-11.module+el8.6.0+23193+c3786137.1
  • perl-FCGI RHEL 8.2 AUS 1:0.78-11.module+el8.2.0+23234+edafdda3.1
  • perl-FCGI RHEL 8.4 AUS 1:0.78-11.module+el8.4.0+23229+35c4aba7.1
  • perl-FCGI RHEL 8.8 TUS, RHEL 8.8 E4S 1:0.78-11.module+el8.8.0+23188+f6366248.1
  • perl-FCGI RHEL 9.2 E4S 1:0.79-8.el9_2.1

red hat advisories RHSA-2025:8890RHSA-2025:8829RHSA-2025:8703RHSA-2025:8698RHSA-2025:8696RHSA-2025:8697

  • perl-FCGI AlmaLinux 9 1:0.79-8.1.el9_6
  • perl-FCGI AlmaLinux 10 1:0.82-13.1.el10_0
  • perl-FCGI AlmaLinux 8 1:0.78-12.module_el8.10.0+4013+e6a7e623
  • perl-FCGI AlmaLinux 8 1:0.78-12.module_el8.10.0+4012+cd64a238
  • perl-FCGI AlmaLinux 8 1:0.78-12.module_el8.10.0+4011+62915be2

almalinux advisories ALSA-2025:8635ALSA-2025:8636ALSA-2025:8696

  • perl-FCGI Rocky Linux 9 1:0.79-8.1.el9_6
  • perl-FCGI Rocky Linux 10 1:0.82-13.1.el10_0
  • perl-FCGI Rocky Linux 8 1:0.78-12.module+el8.10.0+1990+6591fbc7
  • perl-FCGI Rocky Linux 8 1:0.78-12.module+el8.10.0+1990+7f517b07
  • perl-FCGI Rocky Linux 8 1:0.78-12.module+el8.10.0+1990+99c43398
  • perl-FCGI Rocky Linux 8 1:0.78-12.module+el8.10.0+1990+d30a9ea8

rocky linux advisories RLSA-2025:8635RLSA-2025:8636RLSA-2025:8696

Is CVE-2025-40907 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-40907 updated cvss 7.5

perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

  • Red Hat Enterprise Linux AppStream (v. 8) perl-FCGI 0.78-12.module+el8.10.0+23147+20b7d289, perl-FCGI 0.78-12.module+el8.10.0+23147+63faba8d, perl-FCGI 0.78-12.module+el8.10.0+23147+95b68fad, perl-FCGI 0.78-12.module+el8.10.0+23147+df114ff4
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8696
  • Red Hat Enterprise Linux AppStream (v. 9) perl-FCGI 0.79-8.1.el9_6
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8635
  • Red Hat Enterprise Linux AppStream (v. 10) perl-FCGI 0.82-13.1.el10_0
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8636
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) perl-FCGI 0.78-11.module+el8.2.0+23234+854d7c34.1, perl-FCGI 0.78-11.module+el8.2.0+23234+926f173b.1, perl-FCGI 0.78-11.module+el8.2.0+23234+edafdda3.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8829
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) perl-FCGI 0.78-11.module+el8.4.0+23209+5106d2ab.1, perl-FCGI 0.78-11.module+el8.4.0+23209+97efe810.1, perl-FCGI 0.78-11.module+el8.4.0+23229+35c4aba7.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8703
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) perl-FCGI 0.78-11.module+el8.6.0+23193+53aa8c2a.1, perl-FCGI 0.78-11.module+el8.6.0+23193+6b2b1cae.1, perl-FCGI 0.78-11.module+el8.6.0+23193+83e23a7a.1, perl-FCGI 0.78-11.module+el8.6.0+23193+c3786137.1 Red Hat Enterprise Linux AppStream E4S (v.8.6) perl-FCGI 0.78-11.module+el8.6.0+23193+53aa8c2a.1, perl-FCGI 0.78-11.module+el8.6.0+23193+6b2b1cae.1, perl-FCGI 0.78-11.module+el8.6.0+23193+83e23a7a.1, perl-FCGI 0.78-11.module+el8.6.0+23193+c3786137.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8890
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-FCGI 0.78-11.module+el8.8.0+23188+11a20ed6.1, perl-FCGI 0.78-11.module+el8.8.0+23188+465ac1a4.1, perl-FCGI 0.78-11.module+el8.8.0+23188+d1e34d64.1, perl-FCGI 0.78-11.module+el8.8.0+23188+f6366248.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8698
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perl-FCGI 0.79-8.el9_0.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8678
show 5 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perl-FCGI 0.79-8.el9_2.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8697
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) perl-FCGI 0.79-8.el9_4.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8677
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) perl-FCGI 0.78-11.module+el8.6.0+23193+53aa8c2a.1, perl-FCGI 0.78-11.module+el8.6.0+23193+6b2b1cae.1, perl-FCGI 0.78-11.module+el8.6.0+23193+83e23a7a.1, perl-FCGI 0.78-11.module+el8.6.0+23193+c3786137.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8890
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-FCGI 0.78-11.module+el8.8.0+23188+11a20ed6.1, perl-FCGI 0.78-11.module+el8.8.0+23188+465ac1a4.1, perl-FCGI 0.78-11.module+el8.8.0+23188+d1e34d64.1, perl-FCGI 0.78-11.module+el8.8.0+23188+f6366248.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8698
  • Red Hat Enterprise Linux Server (v. 7 ELS) perl-FCGI 0.74-8.el7_9.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:8625

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/FastCGI-Archives/fcgi2/issues/67 referenced PoC, tagged "exploit" by a source, unverified
  • synacktiv.com https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/perl-catalyst/FCGI/issues/14 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • ETHER FCGI

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-190 Integer Overflow or Wraparound
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.