Skip to content
OpenAdvisories
Medium RHSA-2025:8635 1 CVE

Red Hat Security Advisory: perl-FCGI security update

Published Jun 9, 2025 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream perl-FCGI 1:0.79-8.1.el9_6
Red Hat · RHEL 9 enterprise_linux:9::appstream perl-FCGI-debuginfo 1:0.79-8.1.el9_6
Red Hat · RHEL 9 enterprise_linux:9::appstream perl-FCGI-debugsource 1:0.79-8.1.el9_6

Vulnerabilities 1

  • Medium 5.3
    CVE-2025-40907

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nam…

    ether FCGI libfcgi-perl perl-FCGI Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366847
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8635.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-40907
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40907
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40907
  • article
    http://www.openwall.com/lists/oss-security/2025/04/23/4
  • article
    https://github.com/FastCGI-Archives/fcgi2/issues/67
  • article
    https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.5
  • article
    https://github.com/perl-catalyst/FCGI/issues/14
  • article
    https://patch-diff.githubusercontent.com/raw/FastCGI-Archives/fcgi2/pull/74.patch
  • article
    https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library