CVE-2025-40906

Severity CVSS v4.0:

Pending analysis

Type:

CWE-122 Heap-based Buffer Overflow

Publication date:

16/05/2025

Last modified:

05/09/2025

Description

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.<br /> <br /> Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. <br /> <br /> BSON-XS was the official Perl XS implementation of MongoDB&#39;s BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 9.80 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

9.80

Severity 3.x

CRITICAL

CVE-2025-40906

Description

Impact

References to Advisories, Solutions, and Tools