Refine your search

11 vulnerabilities found for mongodb by mongodb

CVE-2025-13507 (GCVE-0-2025-13507)
Vulnerability from nvd
Published
2025-11-25 04:52
Modified
2025-11-25 16:47
Severity ?
7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-1284 - Improper Validation of Specified Quantity in Input
Summary
Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.
References
Impacted products
Vendor Product Version
MongoDB Inc. MongoDB Server Version: 7.0   < 7.0.26
Version: 8.0   < 8.0.16
Version: 8.2   < 8.2.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13507",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T16:47:33.153336Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T16:47:41.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "7.0.26",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.16",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.2.1",
              "status": "affected",
              "version": "8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e\u003cspan style=\"background-color: transparent;\"\u003eInconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. \u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. \nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-25T04:52:47.714Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-108565"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Time-series operations may cause internal BSON size limit to be exceed",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-13507",
    "datePublished": "2025-11-25T04:52:47.714Z",
    "dateReserved": "2025-11-21T16:20:52.636Z",
    "dateUpdated": "2025-11-25T16:47:41.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12893 (GCVE-0-2025-12893)
Vulnerability from nvd
Published
2025-11-25 05:07
Modified
2025-11-25 16:43
Severity ?
4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
2.3 (Low) - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-295 - Improper Certificate Validation
Summary
Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2
References
Impacted products
Vendor Product Version
MongoDB Inc. MongoDB Server Version: 7.0   < 7.0.26
Version: 8.0   < 8.0.16
Version: 8.2   < 8.2.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T16:43:42.497306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T16:43:49.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Windows"
          ],
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "7.0.26",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.16",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.2.2",
              "status": "affected",
              "version": "8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eClients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eAdditionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2\u003c/span\u003e\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems.\n\nAdditionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. \n\nThis vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-25T05:08:41.827Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-105783"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-12893",
    "datePublished": "2025-11-25T05:07:17.878Z",
    "dateReserved": "2025-11-07T18:24:11.002Z",
    "dateUpdated": "2025-11-25T16:43:49.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-11979 (GCVE-0-2025-11979)
Vulnerability from nvd
Published
2025-10-20 17:47
Modified
2025-10-20 20:21
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
Summary
An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.
References
Impacted products
Vendor Product Version
MongoDB Inc. Server Version: 8.2.0
Version: 8.0.0
Version: 7.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-20T20:21:19.312061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-20T20:21:27.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0",
              "versionType": "Custom"
            },
            {
              "lessThan": "8.0.14",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "Custom"
            },
            {
              "lessThan": "7.0.25",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "Custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eAn authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-20T17:47:57.947Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-105873"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-11979",
    "datePublished": "2025-10-20T17:47:57.947Z",
    "dateReserved": "2025-10-20T17:38:55.869Z",
    "dateUpdated": "2025-10-20T20:21:27.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-10061 (GCVE-0-2025-10061)
Vulnerability from nvd
Published
2025-09-05 20:48
Modified
2025-09-05 21:08
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-20 - Improper Input Validation
Summary
An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2
References
Impacted products
Vendor Product Version
MongoDB Inc MongoDB Server Version: 6.0   < 6.0.25
Version: 7.0   < 7.0.22
Version: 8.0   < 8.0.12
Version: 8.1   < 8.1.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-05T21:07:15.019864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-05T21:08:44.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "6.0.25",
              "status": "affected",
              "version": "6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.22",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.12",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.1.2",
              "status": "affected",
              "version": "8.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2"
            }
          ],
          "value": "An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T20:48:25.215Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-99616"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Malformed $group Query May Cause MongoDB Server to Crash",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-10061",
    "datePublished": "2025-09-05T20:48:25.215Z",
    "dateReserved": "2025-09-05T20:41:48.167Z",
    "dateUpdated": "2025-09-05T21:08:44.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-0755 (GCVE-0-2025-0755)
Vulnerability from nvd
Published
2025-03-18 09:01
Modified
2025-11-03 19:35
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-122 - Heap-based Buffer Overflow
Summary
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
References
Impacted products
Vendor Product Version
MongoDB Inc libbson Version: 0   < 1.27.5
    cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.18.0:alpha:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.18.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.18.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.19.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.19.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.19.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.20.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.20.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.21.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.21.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.21.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.26.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.26.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.26.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*
 Create a notification for this product.
   MongoDB Inc MongoDB Server Version: 8.0   < 8.0.1
Version: 7.0   < 7.0.16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0755",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-18T13:20:06.283556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T13:20:24.560Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:35:09.738Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.18.0:alpha:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.18.0:alpha2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.18.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.19.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.19.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.19.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.20.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.20.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.21.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.21.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.21.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.26.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.26.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.26.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "libbson",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "1.27.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "8.0.1",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.16",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "selmelc"
        }
      ],
      "datePublic": "2025-03-18T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe various \u003ctt\u003ebson_append\u003c/tt\u003e\u0026nbsp;functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16\u003c/p\u003e"
            }
          ],
          "value": "The various bson_append\u00a0functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-24T08:42:52.079Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-94461"
        },
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-5601"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB C Driver bson library may be susceptible to buffer overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-0755",
    "datePublished": "2025-03-18T09:01:04.793Z",
    "dateReserved": "2025-01-27T16:13:12.042Z",
    "dateUpdated": "2025-11-03T19:35:09.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2017-14227 (GCVE-0-2017-14227)
Vulnerability from nvd
Published
2017-09-09 08:00
Modified
2025-11-03 19:25
Severity ?
CWE
  • n/a
Summary
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:25:19.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
          },
          {
            "name": "100825",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100825"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-15T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
        },
        {
          "name": "100825",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100825"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14227",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
            },
            {
              "name": "100825",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100825"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14227",
    "datePublished": "2017-09-09T08:00:00.000Z",
    "dateReserved": "2017-09-09T00:00:00.000Z",
    "dateUpdated": "2025-11-03T19:25:19.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12893 (GCVE-0-2025-12893)
Vulnerability from cvelistv5
Published
2025-11-25 05:07
Modified
2025-11-25 16:43
Severity ?
4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
2.3 (Low) - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-295 - Improper Certificate Validation
Summary
Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2
References
Impacted products
Vendor Product Version
MongoDB Inc. MongoDB Server Version: 7.0   < 7.0.26
Version: 8.0   < 8.0.16
Version: 8.2   < 8.2.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T16:43:42.497306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T16:43:49.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Windows"
          ],
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "7.0.26",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.16",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.2.2",
              "status": "affected",
              "version": "8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eClients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eAdditionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2\u003c/span\u003e\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems.\n\nAdditionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. \n\nThis vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-25T05:08:41.827Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-105783"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-12893",
    "datePublished": "2025-11-25T05:07:17.878Z",
    "dateReserved": "2025-11-07T18:24:11.002Z",
    "dateUpdated": "2025-11-25T16:43:49.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13507 (GCVE-0-2025-13507)
Vulnerability from cvelistv5
Published
2025-11-25 04:52
Modified
2025-11-25 16:47
Severity ?
7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-1284 - Improper Validation of Specified Quantity in Input
Summary
Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.
References
Impacted products
Vendor Product Version
MongoDB Inc. MongoDB Server Version: 7.0   < 7.0.26
Version: 8.0   < 8.0.16
Version: 8.2   < 8.2.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13507",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T16:47:33.153336Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T16:47:41.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "lessThan": "7.0.26",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.16",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.2.1",
              "status": "affected",
              "version": "8.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e\u003cspan style=\"background-color: transparent;\"\u003eInconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. \u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: transparent;\"\u003eThis issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. \nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-25T04:52:47.714Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-108565"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Time-series operations may cause internal BSON size limit to be exceed",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-13507",
    "datePublished": "2025-11-25T04:52:47.714Z",
    "dateReserved": "2025-11-21T16:20:52.636Z",
    "dateUpdated": "2025-11-25T16:47:41.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-11979 (GCVE-0-2025-11979)
Vulnerability from cvelistv5
Published
2025-10-20 17:47
Modified
2025-10-20 20:21
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
Summary
An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.
References
Impacted products
Vendor Product Version
MongoDB Inc. Server Version: 8.2.0
Version: 8.0.0
Version: 7.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-20T20:21:19.312061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-20T20:21:27.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "MongoDB Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0",
              "versionType": "Custom"
            },
            {
              "lessThan": "8.0.14",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "Custom"
            },
            {
              "lessThan": "7.0.25",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "Custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eAn authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-20T17:47:57.947Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-105873"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-11979",
    "datePublished": "2025-10-20T17:47:57.947Z",
    "dateReserved": "2025-10-20T17:38:55.869Z",
    "dateUpdated": "2025-10-20T20:21:27.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-0755 (GCVE-0-2025-0755)
Vulnerability from cvelistv5
Published
2025-03-18 09:01
Modified
2025-11-03 19:35
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-122 - Heap-based Buffer Overflow
Summary
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
References
Impacted products
Vendor Product Version
MongoDB Inc libbson Version: 0   < 1.27.5
    cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.17.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.18.0:alpha:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.18.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.18.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.19.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.19.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.19.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.20.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.20.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.21.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.21.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.21.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.0:beta0:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.22.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.23.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.24.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.25.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.26.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.26.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.26.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:libbson:1.27.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*
 Create a notification for this product.
   MongoDB Inc MongoDB Server Version: 8.0   < 8.0.1
Version: 7.0   < 7.0.16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0755",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-18T13:20:06.283556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T13:20:24.560Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:35:09.738Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:mongodb:libbson:0.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.6.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.8.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:0.98.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.1.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.3.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.0:beta1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc3:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc4:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.0:rc6:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.5.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.7.0:rc2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:-:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.0:rc1:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.9.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.10.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.11.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.13.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.14.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.15.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.16.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:beta2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:rc0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.17.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.18.0:alpha:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.18.0:alpha2:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.18.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.19.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.19.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.19.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.20.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.20.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.21.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.21.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.21.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.0:beta0:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.22.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.23.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.24.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.25.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.26.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.26.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.26.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:libbson:1.27.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:mongodb:mongodb:8.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "libbson",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "1.27.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB Server",
          "vendor": "MongoDB Inc",
          "versions": [
            {
              "lessThan": "8.0.1",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.16",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "selmelc"
        }
      ],
      "datePublic": "2025-03-18T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe various \u003ctt\u003ebson_append\u003c/tt\u003e\u0026nbsp;functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16\u003c/p\u003e"
            }
          ],
          "value": "The various bson_append\u00a0functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-24T08:42:52.079Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/SERVER-94461"
        },
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-5601"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB C Driver bson library may be susceptible to buffer overflow",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2025-0755",
    "datePublished": "2025-03-18T09:01:04.793Z",
    "dateReserved": "2025-01-27T16:13:12.042Z",
    "dateUpdated": "2025-11-03T19:35:09.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2017-14227 (GCVE-0-2017-14227)
Vulnerability from cvelistv5
Published
2017-09-09 08:00
Modified
2025-11-03 19:25
Severity ?
CWE
  • n/a
Summary
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:25:19.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
          },
          {
            "name": "100825",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100825"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-15T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
        },
        {
          "name": "100825",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100825"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14227",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489362"
            },
            {
              "name": "100825",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100825"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489355"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1489356"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14227",
    "datePublished": "2017-09-09T08:00:00.000Z",
    "dateReserved": "2017-09-09T00:00:00.000Z",
    "dateUpdated": "2025-11-03T19:25:19.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}