Integer overflow in FCGI - CVE-2025-40907

Vulnerability identifier: #VU110697

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-40907

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to inclusion of code from libfcgi/fcgiapp.c vulnerable to an integer overflow, as described in #VU107896 (CVE-2025-23016). A remote attacker can send a specially crafted request to the application, trigger memory corruption and execute arbitrary code on the system. 

FCGI
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
perl-FCGI
perl-FCGI (Red Hat package)
libfcgi-perl (Ubuntu package)
perl-FCGI-debuginfo
perl-FCGI-debugsource
perl-FCGI-help

Cybersecurity Help is currently unaware of any official solution to address this vulnerability. 

perl-FCGI - addressed in versions 0.74-8, 0.78-12
perl-FCGI (Red Hat package) - addressed in versions 0.74-8.el7_9.1, 0.79-8.el9_0.1, 0.79-8.el9_2.1, 0.79-8.el9_4.1
libfcgi-perl (Ubuntu package) - addressed in versions 0.77-1ubuntu0.1~esm1, 0.78-2ubuntu0.1~esm1, 0.79-1ubuntu0.1
perl-FCGI - update to 0.82-4
perl-FCGI-debuginfo - update to 0.82-4
perl-FCGI-debugsource - update to 0.82-4
perl-FCGI-help - update to 0.82-4
perl-FCGI - addressed in versions 0.82-13.fc41, 0.82-14.fc42

• https://github.com/perl-catalyst/FCGI/issues/14

• Remote code execution in Catalyst FCGI for Perl
• Fedora 42 update for perl-FCGI
• Fedora 41 update for perl-FCGI
• openEuler update for perl-FCGI
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for perl-FCGI
• Red Hat Enterprise Linux 9 update for perl-FCGI
• Red Hat Enterprise Linux 9 update for perl-FCGI
• Red Hat Enterprise Linux 9 update for perl-FCGI
• Red Hat Enterprise Linux 8 update for the perl-FCGI:0.78 module
• Ubuntu update for libfcgi-perl
• Anolis OS update for perl-FCGI:0.78 module
• Anolis OS update for perl-FCGI
• Red Hat Enterprise Linux 8 update for the perl-FCGI:0.78 module