PT-2025-21645 · Fcgi+7 · Fcgi+7
Synacktiv
·
Published
2025-01-04
·
Updated
2025-11-12
·
CVE-2025-40907
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions:
FCGI versions 0.44 through 0.82
Description:
The included FastCGI library in FCGI is affected, causing an integer overflow and resultant heap-based buffer overflow via crafted
nameLen or valueLen values in data to the IPC socket. This occurs in the ReadParams function in fcgiapp.c.Recommendations:
For FCGI versions 0.44 through 0.82, consider disabling the
ReadParams function in fcgiapp.c as a temporary workaround until a patch is available. Restrict access to the IPC socket to minimize the risk of exploitation. Avoid using crafted nameLen or valueLen values in data to the IPC socket until the issue is resolved.Exploit
Fix
Integer Overflow
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Fcgi
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu