{"id":"CVE-2025-40913","summary":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow","details":"Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.\n\nNet::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.","aliases":["CVE-2025-40914","GHSA-j3xv-6967-cv88"],"modified":"2026-08-12T15:16:30.811650Z","published":"2025-07-16T14:05:33.899Z","database_specific":{"cwe_ids":["CWE-1395"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40913.json","cna_assigner":"CPANSec"},"references":[{"type":"WEB","url":"https://cpan.org/modules"},{"type":"WEB","url":"https://metacpan.org/release/ATRODO/Net-Dropbear-0.16/source/dropbear/libtommath/bn_mp_grow.c"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2023-36328"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40913.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-j3xv-6967-cv88"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40913"},{"type":"FIX","url":"https://github.com/libtom/libtommath/pull/546"},{"type":"PACKAGE","url":"https://github.com/atrodo/Net-Dropbear"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libtom/libtommath","events":[{"introduced":"390fa39dc519551eb3c6e93fe3fa52a9ec9d9833"},{"fixed":"14161e843e7aee94c41370b0a731182e9618f796"}],"database_specific":{"extracted_events":[{"introduced":"0.01"},{"last_affected":"0.16"},{"introduced":"0"},{"fixed":"0.16"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["0.15","0.14","0.13","0.12","0.11","0.10","0.09","0.08","0.07","0.06","0.05","0.03","0.02","0.04","0.01"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40913.json","vanir_signatures_modified":"2026-08-12T15:16:30Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["169254536396660110664229355215601700318","297875765010984910914552456538802724383","134844543582037916875242563252939514481","105777215631369147596064986459258208240","290373305309747791242442633442368437945","108652346069504060903020114438035793198","35705860364973434280658923307286619784","98134929519474559718363587570804879159"],"threshold":0.9},"id":"CVE-2025-40913-04547a65","signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"tommath.h"}},{"signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_div.c","function":"mp_div"},"deprecated":false,"digest":{"function_hash":"244374779624400871205359063011871597151","length":3551},"id":"CVE-2025-40913-0b39dace","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_gcd.c","function":"mp_gcd"},"deprecated":false,"digest":{"function_hash":"103169231688671981001458931290089879291","length":1908},"id":"CVE-2025-40913-16a3b8b1"},{"source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_mul_2d.c","function":"mp_mul_2d"},"deprecated":false,"digest":{"function_hash":"105629234812175681995065599423747489667","length":771},"id":"CVE-2025-40913-228ecb59","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"demo/demo.c"},"deprecated":false,"digest":{"line_hashes":["142070509045760169266997402160850288607","69005559693554280127118096355703508639","183716597397754321438411698849574469949","43845798914363189845908512178455423669","22948606996879533102455616271167282307","116067058435213756510371248752310762619","43672723571289196632840303419496991166","17343021799511837577555836670727085246","274487981249259170429675047358407672365","247141722874758227153714663395253955232"],"threshold":0.9},"id":"CVE-2025-40913-2b08dc5f"},{"target":{"file":"pre_gen/mpi.c","function":"mp_mul_2"},"deprecated":false,"digest":{"function_hash":"207590492895768791768558286634017480532","length":865},"id":"CVE-2025-40913-3565b638","signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796"},{"digest":{"line_hashes":["51377156471803300497742090097010438920","54372820595521107272010861915056467644","305808418794488610844086662638795863043","225752243827816157291282536814859006093","297305349499520914503275244017210355626","34603298348893540938950286425913012045","290436325721395813142721993750267261314","133999687051936641698965551384540532489","10021822032511157461433427591248279444","104344171616085731374617147791019287943","79811273998899660788065839189596366570","64195221946382308676319731202936826692","59311946325800366102108256257982490797"],"threshold":0.9},"id":"CVE-2025-40913-391be48b","signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_div.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"151953582867135140842292066613527551014","length":185},"id":"CVE-2025-40913-3fe36db7","signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_clamp.c","function":"mp_clamp"}},{"deprecated":false,"digest":{"line_hashes":["141275985747092757015477223532224385229","35612398095359768562927076416927453506","193625638883949693261268417665287740163","171211128564032971483225786771221727650","129339461559506596309872127237363475481","84349378826131626429315196960030697656","301971370561313663018048565776723478943","278749429511262454651376622208974506667"],"threshold":0.9},"id":"CVE-2025-40913-548d3f47","signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_div_2d.c"}},{"id":"CVE-2025-40913-5baadf20","signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"pre_gen/mpi.c","function":"mp_div"},"deprecated":false,"digest":{"function_hash":"244374779624400871205359063011871597151","length":3551}},{"deprecated":false,"digest":{"line_hashes":["339716091062311959574860401632589801509","140754812946069919512942945430693032473","106101233347691009473702749731105242719","320159565363473022372376085028627308388","188919389843281937859573560123371158907","80199461794675854179588590206888359228","104836240287054117681629280152183486726","240321382543265133501791734242136921173","146523463402953033375405526635806061427","318617158334839047969317867842354838272","97358709785062095088221284952925143769","201726396233724866959102829298441929940","37348272457488638825107671201508970174","214787961501861407845588577008517863973","6715186000167554477685253061300571174","202719692475667849728986986297903746334","73315557789883359858716973158670927476","246884676168343005652623851311309867361","82767095506054924623486762752475797409","333547099866279666360791885988869294326","157156239995752693732692873762164392873","75948454730135819647564831483412698906","206567197784490729733388384859121898328","188923406713387966795050357127203999737","42975537781267604857657967815166469394","31629102021808347399798173768739651587","242796334836422573221874582991315450955","29337885828690065914851856860602560223","139304129923140066004233881336957566117","297351349394862676333207319400683201633","312707307050632943358793914915677842363","68910476622697710627508794585506499984","327816293188489939400603138335321126146","26881971263438365709372488823142596884","87881027213455721778679932491851316291","164137667383145650567805436582699942720","166773816184879829956592867653151274854","329574818852629318917989827427868138693","294384413930329861681037092154681417235","177546421464511680052151338280229918247","214256611525227965400213314502293024853","264892023339393172191420661766888536275","12017922719922600293239091193000330651","237872311401434630081032407738012460680","51377156471803300497742090097010438920","54372820595521107272010861915056467644","305808418794488610844086662638795863043","225752243827816157291282536814859006093","297305349499520914503275244017210355626","34603298348893540938950286425913012045","290436325721395813142721993750267261314","133999687051936641698965551384540532489","10021822032511157461433427591248279444","104344171616085731374617147791019287943","79811273998899660788065839189596366570","64195221946382308676319731202936826692","59311946325800366102108256257982490797","268300614359623882535698247680868262129","170781592223004634399695367370094354634","92741109194779727140896368477059654955","119854552534463782648250531559050804302","180353376432780086145952616469766303957","12105087282886182917707983759920478267","298970863982684123711687120624913493865","284321724801132298601452527079498433061","317561659495175696491550448435735733916","11018843843540205528541541341732864279","324882282028398730846058539265881126824","141275985747092757015477223532224385229","35612398095359768562927076416927453506","193625638883949693261268417665287740163","171211128564032971483225786771221727650","129339461559506596309872127237363475481","84349378826131626429315196960030697656","301971370561313663018048565776723478943","278749429511262454651376622208974506667","265205107290150355630208538547260767866","293687050815828960661136809955768329948","129418112894751826434321180073247707654","124054414815371999162506593076032056674","201368064157543078878292329460041801644","41003772978333428141466626238303736634","171889086167565991010708892212093845221","92539243772963078602806042354142391219","105723127165599512482355589475931816501","61693427281995831725247548656820957624","264559456493805004289727404599795309123","338579041805231546385619952478069431485","94301654585751627470215256044964769911","89219729363978747224589924902877169797","67634693432613182964557293282087770510","171889086167565991010708892212093845221","92539243772963078602806042354142391219","105723127165599512482355589475931816501","61693427281995831725247548656820957624","16093760905558512591727148141442707511","118467111891865325584345724537971449995","181993490851280537233247690556018242151","175598698346640063255139976025187866136","193338250934474200065161553435831103426","301276255714132437659821531791691240547","208570273650958309205383809142958752293","230820503246576636811756955034672049624","321290448940253549723201817122127311420","323493364909321733680576491204116751788","134216750376629693210065807446211294006","227289573862703300683996300906690500829","162138421839045301253642229285247014692","247341306569482754618600501215110425753","34979860787543976512089833489291900019","73957032411923445797025475884645973255","161453193382736930494384292836061539767","246004867608067336063471543302156507060","120892348553021072064763685790758464957","207149867519840363244915937088937733507","50900000020849923150163963223236701302","47385285603920250344296632687392686198","209677594257821270191396029114900578627","337970145614701233501600516083453136452","191966705394986811826238252471466342773","83401646652331120771713013781776447437","172140526442953803865887893590888518532","180778726569092998803711027507157044393","95743984216530227818109606852919304441","93587256263213378580524601731481543779","194911305594019702501781460787225278196","130023616284555030586422979135542352260","89061144180040259228935166645762150187","132129788691794322306559604548035444964","330324939121309620085839543880704049353","284032026982229946526304037328100251961","327978188966282987111390459472469662456","182155948136444731857793200033727731529","334471842743294025233007222148285964868","79880551286072036352832176489372283255","105207762398936202175347874507879054162","210182066625349259683291636225614109991","103897270865868569326250112531995426876","97734471602505024587533412804413297549","109370608248255805593462677107226771895","205778989448451440319274544588453540907","219963285003967106147689244974149892598","55935163557060032654080430742003939637","320547504525073456852589226462664767206","313151269239362905247027495839510100140","104658841045074102351243300290201676412","121356185116145725514365290455683146339","150852938962042499588157443493093816935","189353246071007445740312301087481937460","2770190262363763777167398830239739305","313426178595869336370757190053053984757","146454298069244140199998418614614747620","66598759873336590640864194676046743516","279227002217253126044718643137340717056","182284146106367149146112099989039564806","230559709738561544488252312921920255223","298510473961216232581634315418917575998","307190702122427672579232762623384654290","4170910506936033997051226166164543050","274345828408471372452975106716060220022","244294102653896918832882147866417831690","187338444995315231861381570671402987707","38408599125098993381909553233015784110","279880431100184063600938126425636402919","86562709785543581468395294148326518190","315641556292597079567908342722436156411","15794540558550703674514654615479886216","316410940732549244963855996419949299005","324882282028398730846058539265881126824","48710428481473283324243383727940741825","210979503620619877837981217065141761650","19390875991075408953641878418906825832","51527843704467994445093395038759147910","33685424585450935571327455122602759903","197127294563954283722847832275176948690","161463157471113337982459535761503247731","255412100922895862742206096888809971190","326973146208394804785669405223593251350","83881542820886307673375408598076676146","131025543564599524148273307130782193829","326441954625459065905856142771157947021","61556572105287762282458001632335898758"],"threshold":0.9},"id":"CVE-2025-40913-60bbbb2b","signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"pre_gen/mpi.c"}},{"signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"function":"mp_mul_2","file":"bn_mp_mul_2.c"},"deprecated":false,"digest":{"length":865,"function_hash":"207590492895768791768558286634017480532"},"id":"CVE-2025-40913-744c0ecb","signature_type":"Function"},{"source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_clamp.c"},"deprecated":false,"digest":{"line_hashes":["166773816184879829956592867653151274854","329574818852629318917989827427868138693","294384413930329861681037092154681417235","177546421464511680052151338280229918247","214256611525227965400213314502293024853"],"threshold":0.9},"id":"CVE-2025-40913-74759c59","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"pre_gen/mpi.c","function":"mp_div_2d"},"deprecated":false,"digest":{"function_hash":"244473536631399695929011571475666219453","length":1028},"id":"CVE-2025-40913-753f42e7"},{"signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"function":"mp_div_2d","file":"bn_mp_div_2d.c"},"deprecated":false,"digest":{"length":1028,"function_hash":"244473536631399695929011571475666219453"},"id":"CVE-2025-40913-844c50c9","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"pre_gen/mpi.c","function":"mp_mul_2d"},"deprecated":false,"digest":{"function_hash":"105629234812175681995065599423747489667","length":771},"id":"CVE-2025-40913-86ce1760","signature_type":"Function"},{"target":{"file":"bn_mp_mul_2d.c"},"deprecated":false,"digest":{"line_hashes":["48710428481473283324243383727940741825","210979503620619877837981217065141761650","19390875991075408953641878418906825832","51527843704467994445093395038759147910","33685424585450935571327455122602759903","197127294563954283722847832275176948690","161463157471113337982459535761503247731","255412100922895862742206096888809971190","326973146208394804785669405223593251350","83881542820886307673375408598076676146"],"threshold":0.9},"id":"CVE-2025-40913-9ea62880","signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796"},{"digest":{"function_hash":"180404540226954837024464644647231982003","length":21528},"id":"CVE-2025-40913-a3ec6c6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"demo/demo.c","function":"main"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"151953582867135140842292066613527551014","length":185},"id":"CVE-2025-40913-bad040ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"pre_gen/mpi.c","function":"mp_clamp"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_mul_2.c"},"deprecated":false,"digest":{"line_hashes":["146454298069244140199998418614614747620","66598759873336590640864194676046743516","279227002217253126044718643137340717056","182284146106367149146112099989039564806","230559709738561544488252312921920255223","298510473961216232581634315418917575998","307190702122427672579232762623384654290","4170910506936033997051226166164543050","274345828408471372452975106716060220022","244294102653896918832882147866417831690","187338444995315231861381570671402987707","38408599125098993381909553233015784110","279880431100184063600938126425636402919","86562709785543581468395294148326518190","315641556292597079567908342722436156411","15794540558550703674514654615479886216","316410940732549244963855996419949299005","324882282028398730846058539265881126824"],"threshold":0.9},"id":"CVE-2025-40913-daaaf063"},{"deprecated":false,"digest":{"line_hashes":["120892348553021072064763685790758464957","207149867519840363244915937088937733507","50900000020849923150163963223236701302","47385285603920250344296632687392686198","209677594257821270191396029114900578627","337970145614701233501600516083453136452","191966705394986811826238252471466342773","83401646652331120771713013781776447437","172140526442953803865887893590888518532","180778726569092998803711027507157044393","95743984216530227818109606852919304441","93587256263213378580524601731481543779","194911305594019702501781460787225278196","130023616284555030586422979135542352260","89061144180040259228935166645762150187","132129788691794322306559604548035444964","330324939121309620085839543880704049353","284032026982229946526304037328100251961","327978188966282987111390459472469662456","182155948136444731857793200033727731529"],"threshold":0.9},"id":"CVE-2025-40913-edae2585","signature_type":"Line","signature_version":"v1","source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"bn_mp_gcd.c"}},{"source":"https://github.com/libtom/libtommath/commit/14161e843e7aee94c41370b0a731182e9618f796","target":{"file":"pre_gen/mpi.c","function":"mp_gcd"},"deprecated":false,"digest":{"function_hash":"103169231688671981001458931290089879291","length":1908},"id":"CVE-2025-40913-f2eac098","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}