---
cve: "CVE-2025-40906"
severity: "CRITICAL"
cvss: 9.8
epss: "0.6%"
vendor: "MONGODB"
kev: false
exploited: false
published: "2025-05-16 16:15:41"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T12:35:58+01:00"
---

# CVE-2025-40906

> 9.8 CRITICAL

## Beschreibung

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.

Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. 

BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

## CNA-Record (Kanon, cvelistV5)

- CNA: **CPANSec**
- State: PUBLISHED
- Stand: 2025-09-09 13:54:31

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-1104** — Use of Unmaintained Third Party Components
  The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
- **CWE-122** — Heap-based Buffer Overflow
  The product writes past the end of a buffer that was allocated on the heap.
- **CWE-1395** — Dependency on Vulnerable Third-Party Component
  The product has a dependency on a third-party component that contains one or more known vulnerabilities.
- **CWE-190** — Integer Overflow or Wraparound
  The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

## Referenzen

- <https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html>
- <https://www.mongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-40906/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_