https://seclists.org/oss-sec/2025/q2/80: CVE-2025-23016: Integer & buffer overflow in fastcgi < 2.4.5
Published Apr 23, 2025
·Updated
Affected Software
1 affected component
FastCGI fastcgi<2.4.5
Frequently Asked Questions
1
What is the severity of CVE-2025-23016?
CVE-2025-23016 has been classified as a critical severity vulnerability due to its potential for exploitation through heap-based buffer overflows.
2
How do I fix CVE-2025-23016?
To fix CVE-2025-23016, upgrade the FastCGI library to version 2.4.5 or later.
3
What causes CVE-2025-23016?
CVE-2025-23016 is caused by an integer overflow that results in a heap-based buffer overflow when processing crafted nameLen or valueLen values.
4
Which versions of FastCGI are affected by CVE-2025-23016?
FastCGI versions prior to 2.4.5 are affected by CVE-2025-23016.
5
Is CVE-2025-23016 exploitable remotely?
Yes, CVE-2025-23016 is exploitable remotely through crafted data sent to the IPC socket.