CVE-2025-40913 Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow
An integer overflow in the embedded libtommath library within Net::Dropbear can lead to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40913?
CVE-2025-40913 is a medium-severity vulnerability in ATRODO Net::Dropbear, published on 16 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.
Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.
Weakness: CWE-1395
Which versions are affected by CVE-2025-40913?
How do I fix CVE-2025-40913?
Upgrade to a fixed version.
Is CVE-2025-40913 being exploited?
There is no known exploitation of CVE-2025-40913 in the wild and no public exploit code.
Sources
Also known as AZL-65547, AZL-65550, AZL-65571, GHSA-x86q-3xjx-wg89.