CVE-2025-40913: Atrodo Net::dropbear

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow. Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Affected products

• Atrodo Net::dropbear: from 0.01, up to and including 0.16

Published 2025-07-16. Last modified 2026-06-17.