Skip to content
OpenAdvisories
Medium RHSA-2025:8698 1 CVE

Red Hat Security Advisory: perl-FCGI:0.78 security update

Published Jun 10, 2025 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream perl-FCGI 1:0.78-11.module+el8.8.0+23188+f6366248.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream perl-FCGI-debuginfo 1:0.78-11.module+el8.8.0+23188+f6366248.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream perl-FCGI-debugsource 1:0.78-11.module+el8.8.0+23188+f6366248.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream perl-FCGI 1:0.78-11.module+el8.8.0+23188+f6366248.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream perl-FCGI-debuginfo 1:0.78-11.module+el8.8.0+23188+f6366248.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream perl-FCGI-debugsource 1:0.78-11.module+el8.8.0+23188+f6366248.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2025-40907

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

    FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nam…

    ether FCGI libfcgi-perl perl-FCGI Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366847
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8698.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-40907
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40907
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40907
  • article
    http://www.openwall.com/lists/oss-security/2025/04/23/4
  • article
    https://github.com/FastCGI-Archives/fcgi2/issues/67
  • article
    https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.5
  • article
    https://github.com/perl-catalyst/FCGI/issues/14
  • article
    https://patch-diff.githubusercontent.com/raw/FastCGI-Archives/fcgi2/pull/74.patch
  • article
    https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library