CVE-2025-40907

CVE-2025-40907 describes an integer overflow vulnerability, leading to a heap-based buffer overflow, within the FastCGI fcgi2 library (versions 0.44 through 0.82) used by Perl's FCGI module. This flaw, also tracked as CVE-2025-23016, occurs when processing crafted nameLen or valueLen data sent to the IPC socket. Rated as Medium severity (CVSS 5.3), the vulnerability is network-exploitable with low attack complexity and no user interaction required, potentially leading to a denial of service. While the impact is currently assessed as low for availability and none for confidentiality or integrity, the underlying buffer overflow could have more severe consequences. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability. It is not listed on CISA's KEV catalog.