Fluid Attacks Database

Description

FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	libfcgi	=2.4.2-2 \|\| >=0 <2.4.2-2+deb12u1	2.4.2-2+deb12u1
debian 11	libfcgi	=2.4.2-2 \|\| >=0 <2.4.2-2+deb11u1	2.4.2-2+deb11u1
debian 13	libfcgi	>=0 <2.4.5-0.1	2.4.5-0.1
debian 14	libfcgi	>=0 <2.4.5-0.1	2.4.5-0.1

Aliases

1. CVE-2025-230162. NVD-2025-230163. OSV-DEBIAN-2025-230164. OSV-2025-230165. SECURITY-TRACKER-CVE-2025-23016

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.