CVE-2025-40907: medium-severity vulnerability in ETHER FCGI
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Perl FCGI module versions 0.44 to 0.82 include a vulnerable FastCGI library that can be exploited by sending crafted data to cause a crash or potentially execute code on the server.
An integer overflow in the FastCGI fcgi2 library's ReadParams function (fcgiapp.c) allows remote attackers to trigger a heap-based buffer overflow via malicious nameLen or valueLen values in IPC socket data. Exploitation requires the ability to send crafted FastCGI protocol messages to the application.