Integer overflow in fcgi2 - CVE-2025-23016

Vulnerability identifier: #VU107896

CSH Severity: Critical

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-23016

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an integer overflow within the ReadParams() function in fcgiapp.c. A remote attacker can pass specially crafted "nameLen" or "valueLen" values in data to the IPC socket, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

fcgi2
Oracle Enterprise Communications Broker
Anolis OS
Fedora
openEuler
Oracle Communications Core Session Manager
Oracle Communications Session Border Controller
perl-FCGI
perl-FCGI-help
perl-FCGI-debuginfo
perl-FCGI-debugsource
fcgi
fcgi-debuginfo
fcgi-devel
fcgi-debugsource

Install update from vendor's website.

fcgi2 - update to 2.4.5
perl-FCGI - addressed in versions 0.74-8, 0.78-12
perl-FCGI-help - update to 0.82-4
perl-FCGI - update to 0.82-4
perl-FCGI-debuginfo - update to 0.82-4
perl-FCGI-debugsource - update to 0.82-4
fcgi - addressed in versions 2.4.0-52.el8, 2.4.0-52.el9, 2.4.0-52.el10_1, 2.4.0-52.fc41, 2.4.0-52.fc42
fcgi-debuginfo - addressed in versions 2.4.2-2, 2.4.2-3
fcgi-devel - addressed in versions 2.4.2-2, 2.4.2-3
fcgi-debugsource - addressed in versions 2.4.2-2, 2.4.2-3
fcgi - addressed in versions 2.4.2-2, 2.4.2-3

• https://github.com/FastCGI-Archives/fcgi2/issues/67
• https://github.com/advisories/GHSA-9825-56cx-cfg6
• https://www.openwall.com/lists/oss-security/2025/04/23/4

• Remote code execution in FastCGI fcgi2
• openEuler update for fcgi
• Fedora 42 update for fcgi
• Fedora 41 update for fcgi
• Fedora EPEL 10.1 update for fcgi
• Fedora EPEL 9 update for fcgi
• Fedora EPEL 8 update for fcgi
• openEuler update for perl-FCGI
• Integer overflow in Oracle Communications Core Session Manager
• Integer overflow in Oracle Communications Session Border Controller
• Integer overflow in Oracle Enterprise Communications Broker
• Anolis OS update for perl-FCGI:0.78 module
• Anolis OS update for perl-FCGI
• openEuler 24.03 LTS SP2 update for fcgi