CVE & CISA-KEV CatalogNVD
CVE-2025-40909
MEDIUM5.9
CVSS v3
Description
Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
How to fix
Remediation Available
perlDebian
Fixed in:5.32.1-4+deb11u5CVE-2025-40909
Fixed in:5.36.0-7+deb12u3CVE-2025-40909
Fixed in:5.40.1-5CVE-2025-40909
Fixed in:5.40.1-5CVE-2025-40909
perlRocky
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.x86_64::perl:5.32RHSA-2026:50262
Fixed in:4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.ppc64le::perl:5.32RHSA-2026:50262
Fixed in:4:5.32.1-474.module+el8.10.0+24099+8aa2f756.aarch64::perl:5.32RHSA-2026:8096
perlRed Hat / RHEL
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.40.2-512.2.el10_0RHSA-2025:12056
Fixed in:4:5.32.1-474.module+el8.10.0+24099+8aa2f756.ppc64le::perl:5.32RHSA-2026:8096
Fixed in:4:5.32.1-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32RHSA-2026:37070
Fixed in:4:5.32.1-474.module+el8.10.0+24099+8aa2f756.s390x::perl:5.32RHSA-2026:8096
perl-Algorithm-DiffRocky
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:1.1903-10.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:1.1903-10.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
perl-Algorithm-DiffRed Hat / RHEL
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.1903-10.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.1903-10.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:1.1903-10.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
perl-Archive-TarRocky
Fixed in:0:2.38-3.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:2.38-3.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
perl-Archive-TarRed Hat / RHEL
Fixed in:0:2.38-3.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.38-3.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:2.38-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
perl-Archive-ZipRed Hat / RHEL
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.68-3.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:1.68-3.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
perl-Archive-ZipRocky
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:1.68-3.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.68-3.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:1.68-3.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
perl-Attribute-HandlersRocky
Fixed in:0:1.03-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.01-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.01-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.01-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:0.99-423.el8_10RHSA-2025:11805
Fixed in:0:1.01-481.el9_4.1RHSA-2025:11545
Fixed in:0:1.01-481.1.el9_6RHSA-2025:11804
perl-Attribute-HandlersRed Hat / RHEL
Fixed in:0:1.03-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.01-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:1.01-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.01-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:0.99-423.el8_10RHSA-2025:11805
Fixed in:0:1.01-481.el9_4.1RHSA-2025:11545
Fixed in:0:1.01-481.1.el9_6RHSA-2025:11804
perl-AutoLoaderRed Hat / RHEL
Fixed in:0:5.74-512.2.el10_0RHSA-2025:12056
Fixed in:0:5.74-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:5.74-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:5.74-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:5.74-481.1.el9_6RHSA-2025:11804
Fixed in:0:5.74-481.el9_4.1RHSA-2025:11545
perl-AutoLoaderRocky
Fixed in:0:5.74-512.2.el10_0RHSA-2025:12056
Fixed in:0:5.74-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:5.74-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:5.74-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:5.74-481.1.el9_6RHSA-2025:11804
Fixed in:0:5.74-481.el9_4.1RHSA-2025:11545
perl-AutoSplitRocky
Fixed in:0:5.74-512.2.el10_0RHSA-2025:12056
Fixed in:0:5.74-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:5.74-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:5.74-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:5.74-481.1.el9_6RHSA-2025:11804
Fixed in:0:5.74-481.el9_4.1RHSA-2025:11545
perl-AutoSplitRed Hat / RHEL
Fixed in:0:5.74-512.2.el10_0RHSA-2025:12056
Fixed in:0:5.74-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:5.74-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:5.74-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:5.74-481.1.el9_6RHSA-2025:11804
Fixed in:0:5.74-481.el9_4.1RHSA-2025:11545
perl-BRocky
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.80-472.module+el8.8.0+24404+b3ad2701.1.ppc64le::perl:5.32RHSA-2026:50262
Fixed in:0:1.80-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32RHSA-2026:37070
Fixed in:0:1.80-474.module+el8.10.0+24099+8aa2f756.x86_64::perl:5.32RHSA-2026:8096
Fixed in:0:1.80-474.module+el8.10.0+24099+8aa2f756.s390x::perl:5.32RHSA-2026:8096
perl-BRed Hat / RHEL
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.80-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32RHSA-2026:37070
Fixed in:0:1.80-472.module+el8.8.0+24404+b3ad2701.1.ppc64le::perl:5.32RHSA-2026:50262
Fixed in:0:1.80-472.module+el8.8.0+24404+b3ad2701.1.x86_64::perl:5.32RHSA-2026:50262
Fixed in:0:1.80-474.module+el8.10.0+24099+8aa2f756.x86_64::perl:5.32RHSA-2026:8096
perl-B-debuginfoRocky
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.80-472.module+el8.8.0+24404+b3ad2701.1.ppc64le::perl:5.32RHSA-2026:50262
Fixed in:0:1.80-472.module+el8.8.0+24404+b3ad2701.1.x86_64::perl:5.32RHSA-2026:50262
Fixed in:0:1.80-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32RHSA-2026:37070
Fixed in:0:1.80-474.module+el8.10.0+24099+8aa2f756.x86_64::perl:5.32RHSA-2026:8096
perl-B-debuginfoRed Hat / RHEL
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.89-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.80-474.module+el8.10.0+24099+8aa2f756.ppc64le::perl:5.32RHSA-2026:8096
Fixed in:0:1.80-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32RHSA-2026:37070
Fixed in:0:1.80-472.module+el8.8.0+24404+b3ad2701.1.ppc64le::perl:5.32RHSA-2026:50262
Fixed in:0:1.80-474.module+el8.10.0+24099+8aa2f756.x86_64::perl:5.32RHSA-2026:8096
perl-BenchmarkRocky
Fixed in:0:1.25-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.23-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.23-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:1.23-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.23-481.1.el9_6RHSA-2025:11804
Fixed in:0:1.23-481.el9_4.1RHSA-2025:11545
perl-BenchmarkRed Hat / RHEL
Fixed in:0:1.25-512.2.el10_0RHSA-2025:12056
Fixed in:0:1.23-474.module+el8.10.0+24099+8aa2f756.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:1.23-472.module+el8.8.0+24404+b3ad2701.1.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:1.23-471.module+el8.6.0+24484+7827d5b5.1.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:1.23-481.el9_4.1RHSA-2025:11545
Fixed in:0:1.23-481.1.el9_6RHSA-2025:11804
perl-CPANRocky
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.28-5.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:2.28-5.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
perl-CPANRed Hat / RHEL
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.28-5.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.28-5.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:2.28-5.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
perl-CPAN-DistnameInfoRocky
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:0.12-13.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:0.12-13.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
perl-CPAN-DistnameInfoRed Hat / RHEL
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:0.12-13.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:0.12-13.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:0.12-13.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
perl-CPAN-MetaRocky
Fixed in:0:2.150010-397.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:2.150010-397.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
perl-CPAN-MetaRed Hat / RHEL
Fixed in:0:2.150010-397.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.150010-397.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:2.150010-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
perl-CPAN-Meta-RequirementsRed Hat / RHEL
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.140-397.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.140-397.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
perl-CPAN-Meta-RequirementsRocky
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:2.140-397.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:2.140-397.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:2.140-397.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
perl-CPAN-Meta-YAMLRed Hat / RHEL
Fixed in:0:0.018-1001.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:37070
Fixed in:0:0.018-1001.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:50262
Fixed in:0:0.018-1001.module+el8.10.0+21354+3ad137bb.src::perl:5.32RHSA-2026:8096
Fixed in:0:0.018-1001.module+el8.10.0+21354+3ad137bb.noarch::perl:5.32RHSA-2026:8096
Fixed in:0:0.018-1001.module+el8.6.0+13324+628a2397.noarch::perl:5.32RHSA-2026:50262
Fixed in:0:0.018-1001.module+el8.6.0+13324+628a2397.src::perl:5.32RHSA-2026:37070
This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.
TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityLow
AvailabilityLow
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploit Intelligence
0.38%probability of exploitation in 30 days
30thpercentile
Low risk: more likely to be exploited than 30% of all known CVEs.
References
Related Vulnerabilities
Other CWE-426 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2015-0096 | High | 9.3 | 71% | - | - |
| CVE-2016-10009 | High | 7.3 | 37% | - | Fix |
| CVE-2016-0016 | High | 7.8 | 30% | - | - |
| CVE-2012-1854 | High | 7.8 | 21% | KEV | - |
| CVE-2018-12589 | High | 7.8 | 20% | - | - |
| CVE-2016-5330 | High | 7.8 | 18% | - | Fix |
Common questions
How do I fix CVE-2025-40909?
Published advisories record a fix for 327 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.
Is CVE-2025-40909 being actively exploited?
Not that we know of. CVE-2025-40909 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.38% is the estimated probability that it will be exploited in the next 30 days. That is higher than 30% of all scored CVEs.
How severe is CVE-2025-40909?
CVE-2025-40909 has a CVSS v3 base score of 5.9, rated medium. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.
What does CVE-2025-40909 affect?
Published advisories record a fix for perl (Debian), perl (Rocky), perl (Red Hat / RHEL), perl-Algorithm-Diff (Rocky), and 323 more. The list on this page is capped, so there may be more.
Embed a live status badge for CVE-2025-40909
Markdown
[](https://tridentstack.com/cve/CVE-2025-40909)HTML
<a href="https://tridentstack.com/cve/CVE-2025-40909"><img src="https://tridentstack.com/cve/badge/CVE-2025-40909.svg" alt="CVE-2025-40909"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-04-18.