{"id":"CVE-2025-40913","aliases":["AZL-65547","AZL-65550","AZL-65571","EUVD-2025-21701","GHSA-j3xv-6967-cv88","GHSA-x86q-3xjx-wg89"],"status":"published","title":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00327,"percentile":0.25954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395"],"published":"2025-06-11T14:06:53.418Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"tcl","fixed_in":["8.6.13-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libtommath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.1~rc1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.18.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.13-2"}]}]}],"products":[{"vendor":"atrodo","product":"net::dropbear"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36328","tags":["web"]},{"url":"https://github.com/libtom/libtommath/pull/546","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-j3xv-6967-cv88","tags":["advisory"]},{"url":"https://metacpan.org/release/ATRODO/Net-Dropbear-0.16/source/dropbear/libtommath/bn_mp_grow.c","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40913","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x86q-3xjx-wg89"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40913.json","tags":["advisory"]},{"url":"https://github.com/atrodo/Net-Dropbear","tags":["package"]},{"url":"https://metacpan.org/release/MIK/CryptX-0.086/source/src/ltm/bn_mp_grow.c","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40914.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40914","tags":["advisory"]},{"url":"https://github.com/DCIT/perl-CryptX","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-40913","title":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:05:33.899Z","modified":"2025-07-16T20:50:08.893Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-21701","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:05:33Z","modified":"2025-07-16T20:50:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:07.433642Z"}],"ghsa":[{"id":"GHSA-x86q-3xjx-wg89","title":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an...","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T15:32:32Z","modified":"2025-07-16T21:30:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:03:02.777682Z"}],"nvd":[{"id":"CVE-2025-40913","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:15:25.237Z","modified":"2026-06-17T09:22:16.977Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"CVE-2025-40913","title":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:05:33.899Z","modified":"2026-10-28T02:30:30.333635807Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"CVE-2025-40914","title":"Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow","description":"Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow.\n\nCryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-06-11T14:06:53.418Z","modified":"2026-10-28T02:31:07.506059508Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"AZL-65547","title":"CVE-2025-40913 affecting package libtommath 1.3.1~rc1-3","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:15:25Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"AZL-65550","title":"CVE-2025-40913 affecting package samba 4.18.3-2","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:15:25Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"AZL-65571","title":"CVE-2025-40913 affecting package tcl for versions less than 8.6.13-2","description":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","status":"published","published":"2025-07-16T14:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.66471Z"}]}}