CVE-2025-40913

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-40913

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40913.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-40913

Aliases

CVE-2025-40914
GHSA-j3xv-6967-cv88

Downstream

AZL-65547

AZL-65550

AZL-65571

Published

2025-07-16T14:05:33.899Z

Modified

2026-07-22T03:50:24.616329Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow

Details

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.

Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Database specific

{
    "cwe_ids": [
        "CWE-1395"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40913.json"
}

References

Affected packages

Git / github.com/libtom/libtommath

Affected ranges

Type

GIT

Repo

https://github.com/libtom/libtommath

Events

Introduced

390fa39dc519551eb3c6e93fe3fa52a9ec9d9833

Fixed

14161e843e7aee94c41370b0a731182e9618f796

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0.01"
        },
        {
            "last_affected": "0.16"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "0.16"
        }
    ]
}

Affected versions

0.*

0.01

0.02

0.03

0.04

0.05

0.06

0.07

0.08

0.09

0.10

0.11

0.12

0.13

0.14

0.15

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40913.json"

vanir_signatures

[
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "169254536396660110664229355215601700318",
                "297875765010984910914552456538802724383",
                "134844543582037916875242563252939514481",
                "105777215631369147596064986459258208240",
                "290373305309747791242442633442368437945",
                "108652346069504060903020114438035793198",
                "35705860364973434280658923307286619784",
                "98134929519474559718363587570804879159"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-04547a65",
        "target": {
            "file": "tommath.h"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "244374779624400871205359063011871597151",
            "length": 3551.0
        },
        "id": "CVE-2025-40913-0b39dace",
        "target": {
            "function": "mp_div",
            "file": "bn_mp_div.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "103169231688671981001458931290089879291",
            "length": 1908.0
        },
        "id": "CVE-2025-40913-16a3b8b1",
        "target": {
            "function": "mp_gcd",
            "file": "bn_mp_gcd.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "105629234812175681995065599423747489667",
            "length": 771.0
        },
        "id": "CVE-2025-40913-228ecb59",
        "target": {
            "function": "mp_mul_2d",
            "file": "bn_mp_mul_2d.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "142070509045760169266997402160850288607",
                "69005559693554280127118096355703508639",
                "183716597397754321438411698849574469949",
                "43845798914363189845908512178455423669",
                "22948606996879533102455616271167282307",
                "116067058435213756510371248752310762619",
                "43672723571289196632840303419496991166",
                "17343021799511837577555836670727085246",
                "274487981249259170429675047358407672365",
                "247141722874758227153714663395253955232"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-2b08dc5f",
        "target": {
            "file": "demo/demo.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "207590492895768791768558286634017480532",
            "length": 865.0
        },
        "id": "CVE-2025-40913-3565b638",
        "target": {
            "function": "mp_mul_2",
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "51377156471803300497742090097010438920",
                "54372820595521107272010861915056467644",
                "305808418794488610844086662638795863043",
                "225752243827816157291282536814859006093",
                "297305349499520914503275244017210355626",
                "34603298348893540938950286425913012045",
                "290436325721395813142721993750267261314",
                "133999687051936641698965551384540532489",
                "10021822032511157461433427591248279444",
                "104344171616085731374617147791019287943",
                "79811273998899660788065839189596366570",
                "64195221946382308676319731202936826692",
                "59311946325800366102108256257982490797"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-391be48b",
        "target": {
            "file": "bn_mp_div.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "151953582867135140842292066613527551014",
            "length": 185.0
        },
        "id": "CVE-2025-40913-3fe36db7",
        "target": {
            "function": "mp_clamp",
            "file": "bn_mp_clamp.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "141275985747092757015477223532224385229",
                "35612398095359768562927076416927453506",
                "193625638883949693261268417665287740163",
                "171211128564032971483225786771221727650",
                "129339461559506596309872127237363475481",
                "84349378826131626429315196960030697656",
                "301971370561313663018048565776723478943",
                "278749429511262454651376622208974506667"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-548d3f47",
        "target": {
            "file": "bn_mp_div_2d.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "244374779624400871205359063011871597151",
            "length": 3551.0
        },
        "id": "CVE-2025-40913-5baadf20",
        "target": {
            "function": "mp_div",
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "339716091062311959574860401632589801509",
                "140754812946069919512942945430693032473",
                "106101233347691009473702749731105242719",
                "320159565363473022372376085028627308388",
                "188919389843281937859573560123371158907",
                "80199461794675854179588590206888359228",
                "104836240287054117681629280152183486726",
                "240321382543265133501791734242136921173",
                "146523463402953033375405526635806061427",
                "318617158334839047969317867842354838272",
                "97358709785062095088221284952925143769",
                "201726396233724866959102829298441929940",
                "37348272457488638825107671201508970174",
                "214787961501861407845588577008517863973",
                "6715186000167554477685253061300571174",
                "202719692475667849728986986297903746334",
                "73315557789883359858716973158670927476",
                "246884676168343005652623851311309867361",
                "82767095506054924623486762752475797409",
                "333547099866279666360791885988869294326",
                "157156239995752693732692873762164392873",
                "75948454730135819647564831483412698906",
                "206567197784490729733388384859121898328",
                "188923406713387966795050357127203999737",
                "42975537781267604857657967815166469394",
                "31629102021808347399798173768739651587",
                "242796334836422573221874582991315450955",
                "29337885828690065914851856860602560223",
                "139304129923140066004233881336957566117",
                "297351349394862676333207319400683201633",
                "312707307050632943358793914915677842363",
                "68910476622697710627508794585506499984",
                "327816293188489939400603138335321126146",
                "26881971263438365709372488823142596884",
                "87881027213455721778679932491851316291",
                "164137667383145650567805436582699942720",
                "166773816184879829956592867653151274854",
                "329574818852629318917989827427868138693",
                "294384413930329861681037092154681417235",
                "177546421464511680052151338280229918247",
                "214256611525227965400213314502293024853",
                "264892023339393172191420661766888536275",
                "12017922719922600293239091193000330651",
                "237872311401434630081032407738012460680",
                "51377156471803300497742090097010438920",
                "54372820595521107272010861915056467644",
                "305808418794488610844086662638795863043",
                "225752243827816157291282536814859006093",
                "297305349499520914503275244017210355626",
                "34603298348893540938950286425913012045",
                "290436325721395813142721993750267261314",
                "133999687051936641698965551384540532489",
                "10021822032511157461433427591248279444",
                "104344171616085731374617147791019287943",
                "79811273998899660788065839189596366570",
                "64195221946382308676319731202936826692",
                "59311946325800366102108256257982490797",
                "268300614359623882535698247680868262129",
                "170781592223004634399695367370094354634",
                "92741109194779727140896368477059654955",
                "119854552534463782648250531559050804302",
                "180353376432780086145952616469766303957",
                "12105087282886182917707983759920478267",
                "298970863982684123711687120624913493865",
                "284321724801132298601452527079498433061",
                "317561659495175696491550448435735733916",
                "11018843843540205528541541341732864279",
                "324882282028398730846058539265881126824",
                "141275985747092757015477223532224385229",
                "35612398095359768562927076416927453506",
                "193625638883949693261268417665287740163",
                "171211128564032971483225786771221727650",
                "129339461559506596309872127237363475481",
                "84349378826131626429315196960030697656",
                "301971370561313663018048565776723478943",
                "278749429511262454651376622208974506667",
                "265205107290150355630208538547260767866",
                "293687050815828960661136809955768329948",
                "129418112894751826434321180073247707654",
                "124054414815371999162506593076032056674",
                "201368064157543078878292329460041801644",
                "41003772978333428141466626238303736634",
                "171889086167565991010708892212093845221",
                "92539243772963078602806042354142391219",
                "105723127165599512482355589475931816501",
                "61693427281995831725247548656820957624",
                "264559456493805004289727404599795309123",
                "338579041805231546385619952478069431485",
                "94301654585751627470215256044964769911",
                "89219729363978747224589924902877169797",
                "67634693432613182964557293282087770510",
                "171889086167565991010708892212093845221",
                "92539243772963078602806042354142391219",
                "105723127165599512482355589475931816501",
                "61693427281995831725247548656820957624",
                "16093760905558512591727148141442707511",
                "118467111891865325584345724537971449995",
                "181993490851280537233247690556018242151",
                "175598698346640063255139976025187866136",
                "193338250934474200065161553435831103426",
                "301276255714132437659821531791691240547",
                "208570273650958309205383809142958752293",
                "230820503246576636811756955034672049624",
                "321290448940253549723201817122127311420",
                "323493364909321733680576491204116751788",
                "134216750376629693210065807446211294006",
                "227289573862703300683996300906690500829",
                "162138421839045301253642229285247014692",
                "247341306569482754618600501215110425753",
                "34979860787543976512089833489291900019",
                "73957032411923445797025475884645973255",
                "161453193382736930494384292836061539767",
                "246004867608067336063471543302156507060",
                "120892348553021072064763685790758464957",
                "207149867519840363244915937088937733507",
                "50900000020849923150163963223236701302",
                "47385285603920250344296632687392686198",
                "209677594257821270191396029114900578627",
                "337970145614701233501600516083453136452",
                "191966705394986811826238252471466342773",
                "83401646652331120771713013781776447437",
                "172140526442953803865887893590888518532",
                "180778726569092998803711027507157044393",
                "95743984216530227818109606852919304441",
                "93587256263213378580524601731481543779",
                "194911305594019702501781460787225278196",
                "130023616284555030586422979135542352260",
                "89061144180040259228935166645762150187",
                "132129788691794322306559604548035444964",
                "330324939121309620085839543880704049353",
                "284032026982229946526304037328100251961",
                "327978188966282987111390459472469662456",
                "182155948136444731857793200033727731529",
                "334471842743294025233007222148285964868",
                "79880551286072036352832176489372283255",
                "105207762398936202175347874507879054162",
                "210182066625349259683291636225614109991",
                "103897270865868569326250112531995426876",
                "97734471602505024587533412804413297549",
                "109370608248255805593462677107226771895",
                "205778989448451440319274544588453540907",
                "219963285003967106147689244974149892598",
                "55935163557060032654080430742003939637",
                "320547504525073456852589226462664767206",
                "313151269239362905247027495839510100140",
                "104658841045074102351243300290201676412",
                "121356185116145725514365290455683146339",
                "150852938962042499588157443493093816935",
                "189353246071007445740312301087481937460",
                "2770190262363763777167398830239739305",
                "313426178595869336370757190053053984757",
                "146454298069244140199998418614614747620",
                "66598759873336590640864194676046743516",
                "279227002217253126044718643137340717056",
                "182284146106367149146112099989039564806",
                "230559709738561544488252312921920255223",
                "298510473961216232581634315418917575998",
                "307190702122427672579232762623384654290",
                "4170910506936033997051226166164543050",
                "274345828408471372452975106716060220022",
                "244294102653896918832882147866417831690",
                "187338444995315231861381570671402987707",
                "38408599125098993381909553233015784110",
                "279880431100184063600938126425636402919",
                "86562709785543581468395294148326518190",
                "315641556292597079567908342722436156411",
                "15794540558550703674514654615479886216",
                "316410940732549244963855996419949299005",
                "324882282028398730846058539265881126824",
                "48710428481473283324243383727940741825",
                "210979503620619877837981217065141761650",
                "19390875991075408953641878418906825832",
                "51527843704467994445093395038759147910",
                "33685424585450935571327455122602759903",
                "197127294563954283722847832275176948690",
                "161463157471113337982459535761503247731",
                "255412100922895862742206096888809971190",
                "326973146208394804785669405223593251350",
                "83881542820886307673375408598076676146",
                "131025543564599524148273307130782193829",
                "326441954625459065905856142771157947021",
                "61556572105287762282458001632335898758"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-60bbbb2b",
        "target": {
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "207590492895768791768558286634017480532",
            "length": 865.0
        },
        "id": "CVE-2025-40913-744c0ecb",
        "target": {
            "function": "mp_mul_2",
            "file": "bn_mp_mul_2.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "166773816184879829956592867653151274854",
                "329574818852629318917989827427868138693",
                "294384413930329861681037092154681417235",
                "177546421464511680052151338280229918247",
                "214256611525227965400213314502293024853"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-74759c59",
        "target": {
            "file": "bn_mp_clamp.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "244473536631399695929011571475666219453",
            "length": 1028.0
        },
        "id": "CVE-2025-40913-753f42e7",
        "target": {
            "function": "mp_div_2d",
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "244473536631399695929011571475666219453",
            "length": 1028.0
        },
        "id": "CVE-2025-40913-844c50c9",
        "target": {
            "function": "mp_div_2d",
            "file": "bn_mp_div_2d.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "105629234812175681995065599423747489667",
            "length": 771.0
        },
        "id": "CVE-2025-40913-86ce1760",
        "target": {
            "function": "mp_mul_2d",
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "48710428481473283324243383727940741825",
                "210979503620619877837981217065141761650",
                "19390875991075408953641878418906825832",
                "51527843704467994445093395038759147910",
                "33685424585450935571327455122602759903",
                "197127294563954283722847832275176948690",
                "161463157471113337982459535761503247731",
                "255412100922895862742206096888809971190",
                "326973146208394804785669405223593251350",
                "83881542820886307673375408598076676146"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-9ea62880",
        "target": {
            "file": "bn_mp_mul_2d.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "180404540226954837024464644647231982003",
            "length": 21528.0
        },
        "id": "CVE-2025-40913-a3ec6c6d",
        "target": {
            "function": "main",
            "file": "demo/demo.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "151953582867135140842292066613527551014",
            "length": 185.0
        },
        "id": "CVE-2025-40913-bad040ac",
        "target": {
            "function": "mp_clamp",
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "146454298069244140199998418614614747620",
                "66598759873336590640864194676046743516",
                "279227002217253126044718643137340717056",
                "182284146106367149146112099989039564806",
                "230559709738561544488252312921920255223",
                "298510473961216232581634315418917575998",
                "307190702122427672579232762623384654290",
                "4170910506936033997051226166164543050",
                "274345828408471372452975106716060220022",
                "244294102653896918832882147866417831690",
                "187338444995315231861381570671402987707",
                "38408599125098993381909553233015784110",
                "279880431100184063600938126425636402919",
                "86562709785543581468395294148326518190",
                "315641556292597079567908342722436156411",
                "15794540558550703674514654615479886216",
                "316410940732549244963855996419949299005",
                "324882282028398730846058539265881126824"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-daaaf063",
        "target": {
            "file": "bn_mp_mul_2.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "120892348553021072064763685790758464957",
                "207149867519840363244915937088937733507",
                "50900000020849923150163963223236701302",
                "47385285603920250344296632687392686198",
                "209677594257821270191396029114900578627",
                "337970145614701233501600516083453136452",
                "191966705394986811826238252471466342773",
                "83401646652331120771713013781776447437",
                "172140526442953803865887893590888518532",
                "180778726569092998803711027507157044393",
                "95743984216530227818109606852919304441",
                "93587256263213378580524601731481543779",
                "194911305594019702501781460787225278196",
                "130023616284555030586422979135542352260",
                "89061144180040259228935166645762150187",
                "132129788691794322306559604548035444964",
                "330324939121309620085839543880704049353",
                "284032026982229946526304037328100251961",
                "327978188966282987111390459472469662456",
                "182155948136444731857793200033727731529"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-40913-edae2585",
        "target": {
            "file": "bn_mp_gcd.c"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "103169231688671981001458931290089879291",
            "length": 1908.0
        },
        "id": "CVE-2025-40913-f2eac098",
        "target": {
            "function": "mp_gcd",
            "file": "pre_gen/mpi.c"
        },
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-22T03:50:24Z"