CVE-2025-40906
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.
Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755.
BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MONGODB | BSON::XS | 0 <= 0.8.4 | affected |
Weaknesses
- CWE-1395: CWE-1395 Dependency on Vulnerable Third-Party Component
- CWE-1104: CWE-1104 Use of Unmaintained Third Party Components
- CWE-122: CWE-122 Heap-based Buffer Overflow
- CWE-190: CWE-190 Integer Overflow or Wraparound
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: total
References
- https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
- https://www.mongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.