CVE-2025-40907

Name of the Vulnerable Software and Affected Versions: FCGI versions 0.44 through 0.82

Description: The included FastCGI library in FCGI is affected, causing an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC socket. This occurs in the ReadParams function in fcgiapp.c.

Recommendations: For FCGI versions 0.44 through 0.82, consider disabling the ReadParams function in fcgiapp.c as a temporary workaround until a patch is available. Restrict access to the IPC socket to minimize the risk of exploitation. Avoid using crafted nameLen or valueLen values in data to the IPC socket until the issue is resolved.