CVE-2025-23016: Integer & buffer overflow in fastcgi < 2.4.5
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.5-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23016?
CVE-2025-23016 is classified as a high-severity vulnerability due to its potential to cause a heap-based buffer overflow.
How do I fix CVE-2025-23016?
To fix CVE-2025-23016, upgrade to FastCGI fcgi version 2.4.5 or later, which includes patches for this vulnerability.
What versions of FastCGI are affected by CVE-2025-23016?
CVE-2025-23016 affects versions of FastCGI fcgi from 2.0 up to and including 2.4.4.
What is the impact of CVE-2025-23016 on my system?
The impact of CVE-2025-23016 could allow an attacker to exploit the integer overflow and execute arbitrary code through a crafted IPC socket.
Is CVE-2025-23016 a remote exploit vulnerability?
Yes, CVE-2025-23016 can be exploited remotely if the FastCGI service is accessible over the network.