CVEvulnerability

CVE-2025-40906

9.8 CRITICAL Published 2025-05-16 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-05-16
Last modified
2026-06-17
Assigner
9b29abf9-4ab0-4765-b253-1875cd9b441e
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1104, CWE-122, CWE-190

Description

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

Related

Weakness · CWE (3)

  • CWE-1104 Use of Unmaintained Third Party Components weakness
  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-190 Integer Overflow or Wraparound weakness

Referenced by CWE · observed example (1)

  • CWE-1104 Use of Unmaintained Third Party Components weakness

References