HIGHFixed upstream

CVE-2024-10921

MongoDB Server: malformed BSON leads to buffer over-reads or crashes

Technology

MongoDB

CVSS Score

8.1 / 10.0

Affected Versions

8.0.2 and earlier; 7.0 before 7.0.15; 6.0 before 6.0.19; 5.0 before 5.0.30

Upstream Fix

8.0.3; 7.0.15; 6.0.19; 5.0.30

Published

November 14, 2024

OSSeva Coverage

Fixed upstream

Description

An authorized user can issue specially crafted requests that construct malformed BSON in the server, causing crashes or returning the contents of buffer over-reads of server memory. NVD scores the record 8.1; MongoDB scores it 6.8.

Upstream record: NVD · CVE.org

Is your MongoDB deployment affected?

If you're running 8.0.2 and earlier; 7.0 before 7.0.15; 6.0 before 6.0.19; 5.0 before 5.0.30, you need this patch. Book a discovery call to get covered.

Book a discovery call View MongoDB coverage →