========================================================================
CVE-2025-40906                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2025-40906
   Distribution:  BSON-XS
       Versions:  through 0.8.4

       MetaCPAN:  https://metacpan.org/dist/BSON-XS
       VCS Repo:  https://github.com/mongodb-labs/mongo-perl-bson-xs

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson
1.1.7, which has several vulnerabilities

Description
-----------
BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson
1.1.7, which has several vulnerabilities.

Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437,
CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755.

BSON-XS was the official Perl XS implementation of MongoDB's BSON
serialization, but this distribution has reached its end of life as of
August 13, 2020 and is no longer supported.

Problem types
-------------
CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-1104 Use of Unmaintained Third Party Components

Solutions
---------
Manually remove the bundled version of libbson, update the "bson"
folder with an up-to-date version of libbson's source code and try
building against it.

Consider using a security patched version of BSON::XS from a downstream
packager or OS distribution.

References
----------
https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
https://www.mongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890