Heap-based buffer overflow in ether FCGI
Priority MEDIUM 57CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00676 52nd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed Red Hat: 11 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Red Hat 11 advisories
- RHSA-2025:8890 Released 2025-06-11 · Red Hat rating Importantperl-FCGI:0.78 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.src::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.x86_64::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.6.0+23193+6b2b1cae.1.src::perl-FCGI:0.78 +5
- Red Hat Enterprise Linux AppStream E4S (v.8.6) perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.aarch64::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.ppc64le::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.s390x::perl-FCGI:0.78 +17
- Red Hat Enterprise Linux AppStream TUS (v.8.6) perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.src::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.6.0+23193+53aa8c2a.1.x86_64::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.6.0+23193+6b2b1cae.1.src::perl-FCGI:0.78 +5
- RHSA-2025:8829 Released 2025-06-11 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) perl-FCGI-1:0.78-11.module+el8.2.0+23234+854d7c34.1.src::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.2.0+23234+854d7c34.1.x86_64::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.2.0+23234+926f173b.1.src::perl-FCGI:0.78 +3
- RHSA-2025:8703 Released 2025-06-09 · Red Hat rating Importantperl-FCGI:0.78 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) perl-FCGI-1:0.78-11.module+el8.4.0+23209+5106d2ab.1.src::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.4.0+23209+5106d2ab.1.x86_64::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.4.0+23209+97efe810.1.src::perl-FCGI:0.78 +3
Show 8 more Red Hat advisories
- RHSA-2025:8696 Released 2025-06-09 · Red Hat rating Importantperl-FCGI:0.78 security update
- Red Hat Enterprise Linux AppStream (v. 8) perl-FCGI-1:0.78-12.module+el8.10.0+23147+20b7d289.aarch64::perl-FCGI:0.78, perl-FCGI-1:0.78-12.module+el8.10.0+23147+20b7d289.ppc64le::perl-FCGI:0.78, perl-FCGI-1:0.78-12.module+el8.10.0+23147+20b7d289.s390x::perl-FCGI:0.78 +17
- RHSA-2025:8698 Released 2025-06-09 · Red Hat rating Importantperl-FCGI:0.78 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-FCGI-1:0.78-11.module+el8.8.0+23188+11a20ed6.1.ppc64le::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.8.0+23188+11a20ed6.1.src::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.8.0+23188+11a20ed6.1.x86_64::perl-FCGI:0.78 +9
- Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-FCGI-1:0.78-11.module+el8.8.0+23188+11a20ed6.1.src::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.8.0+23188+11a20ed6.1.x86_64::perl-FCGI:0.78, perl-FCGI-1:0.78-11.module+el8.8.0+23188+465ac1a4.1.src::perl-FCGI:0.78 +5
- RHSA-2025:8697 Released 2025-06-09 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) perl-FCGI-1:0.79-8.el9_2.1
- RHSA-2025:8677 Released 2025-06-09 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) perl-FCGI-1:0.79-8.el9_4.1
- RHSA-2025:8678 Released 2025-06-09 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) perl-FCGI-1:0.79-8.el9_0.1
- RHSA-2025:8636 Released 2025-06-09 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux AppStream (v. 10) perl-FCGI-1:0.82-13.1.el10_0
- RHSA-2025:8635 Released 2025-06-09 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux AppStream (v. 9) perl-FCGI-1:0.79-8.1.el9_6
- RHSA-2025:8625 Released 2025-06-09 · Red Hat rating Importantperl-FCGI security update
- Red Hat Enterprise Linux Server (v. 7 ELS) perl-FCGI-1:0.74-8.el7_9.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:8636 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:8696 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:8635 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:8829 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:8703 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:8890 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:8890 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:8698 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:8678 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:8697 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:8677 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:8890 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:8698 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:8625 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-40907
- 2026-10-03 Alias added: GHSA-488m-4fx8-f36v
- 2026-10-12 EPSS moved to the 50th–90th percentile
References
Exploit 3
Patch 2
More ether vulnerabilities
- TI-2026-39793 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint CVSS 3.1CRITICAL 9.9
- TI-2026-39789 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite CVSS 3.1CRITICAL 9.6
- TI-2026-39790 Link following in etherpad CVSS 3.1MEDIUM 4.2
- TI-2009-04910 Session fixation in ether Catalyst::Plugin::Authentication CVSS 3.1CRITICAL 9.1
- TI-2025-27313 Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated nonces CVSS 3.1HIGH 8.6
- TI-2026-39792 Information disclosure in etherpad CVSS 3.1MEDIUM 6.8
Sources
- CVE-2025-40907 · CVE Program
- CVE-2025-40907 · NVD
- FIRST EPSS
- GHSA-488m-4fx8-f36v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-40907 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences