CVE-2025-40906

Description

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

PUBLISHED Reserved 2025-04-16 | Published 2025-05-16 | Updated 2025-09-09 | Assigner CPANSec

Problem types

CWE-1395 Dependency on Vulnerable Third-Party Component

CWE-1104 Use of Unmaintained Third Party Components

CWE-122 Heap-based Buffer Overflow

CWE-190 Integer Overflow or Wraparound

Product status

References

lists.debian.org/debian-lts-announce/2025/05/msg00012.html mailing-list

www.mongodb.com/...ms/t/mongodb-perl-driver-end-of-life/7890 vendor-advisory

cve.org (CVE-2025-40906)

nvd.nist.gov (CVE-2025-40906)

Download JSON