Skip to content
Fencer Vulns
critical 9.3

CVE-2025-23016 json

FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueL…

published 2025-01-10 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-3075

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Patch / fix

  • fastcgi fcgi 2.4.5
  • libfcgi Debian 12 2.4.2-2+deb12u1
  • libfcgi Debian 14, Debian 13 2.4.5-0.1

debian advisories DEBIAN-CVE-2025-23016

  • libfcgi Ubuntu 22.04 LTS 2.4.2-2ubuntu0.1
  • libfcgi Ubuntu 24.04 LTS 2.4.2-2.1ubuntu0.24.04.1
  • libfcgi Ubuntu 25.10 2.4.5-0.1

ubuntu advisories UBUNTU-CVE-2025-23016

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • FastCGI SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 2.4.0-150000.4.3.1
  • FastCGI SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 2.4.0-169.3.1

suse advisories SUSE-SU-2025:02372-1SUSE-SU-2025:02369-1

  • FastCGI openSUSE Tumbleweed 2.4.6-1.1

opensuse advisories openSUSE-SU-2025:15348-1

  • fcgi CBL-Mariner 2.0, Azure Linux 3.0 2.4.5-1

azure linux advisories AZL-55397AZL-55443

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
13 mo ago

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • synacktiv.com https://www.synacktiv.com/en/publications/cve-2025-23016-exploiting-the-fastcgi-library referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • FastCGI fcgi

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.