by Kastro
Paper/Archive/CVE-2025-40906

CVE-2025-40906

MONGODB BSON::XS — BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.4.504 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

Affected

ProductAffectedFixed inSource
BSON::XS≤ 0.8.4–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reflists.debian.org/debian-lts-announce/2025/05/msg00012.htmladvisorymongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890