CVE-2025-40906

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40906
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40906.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-40906
Downstream
Published
2025-05-16T15:15:49.810Z
Modified
2026-07-15T01:49:20.005755392Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities
Details

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.

Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755.

BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40906.json",
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-1104",
        "CWE-122",
        "CWE-1395",
        "CWE-190"
    ]
}
References

Affected packages

Git / github.com/mongodb-labs/mongo-perl-bson-xs

Affected ranges

Type
GIT
Repo
https://github.com/mongodb-labs/mongo-perl-bson-xs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8a7db1d4d97d424197b1b7308c5face433e9af00
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.4"
        }
    ]
}

Affected versions

release-v0.*
release-v0.2.0
release-v0.2.1
release-v0.2.2
release-v0.4.0
release-v0.4.1
release-v0.4.2
release-v0.4.3
release-v0.4.4
release-v0.4.5
release-v0.4.6
release-v0.6.0
release-v0.8.0
release-v0.8.1
release-v0.8.2
release-v0.8.3
release-v0.8.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40906.json"