BSON Serialization Vulnerabilities in Perl's BSON::XS Library
CVE-2025-40906

9.8CRITICAL

Key Information:

Vendor

Mongodb
Status
Bson::xs
Vendor
CVE Published:
16 May 2025

What is CVE-2025-40906?

BSON::XS for Perl, specifically versions up to 0.8.4, include a bundled version of libbson (1.1.7) that harbors multiple vulnerabilities. These include numerous issues discovered over the years, leading to significant security risks. As this library has reached its end-of-life as of August 13, 2020, it is no longer supported, emphasizing the necessity for users to migrate to alternatives or secure configurations to maintain system integrity.

Affected Version(s)

BSON::XS 0 <= 0.8.4

References

https://lists.debian.org/debian-lts-announce/2025/05/msg0...
mailing-list
https://www.mongodb.com/community/forums/t/mongodb-perl-d...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-40906 : BSON Serialization Vulnerabilities in Perl's BSON::XS Library