Riskcovery

CVE-2021-32040

Large aggregation pipelines with a specific stage can crash mongod under default configuration

State
Published
Severity
6.5 Medium
Published
Apr 12, 2022
Updated
Sep 16, 2024
Reserved
May 5, 2021

Read the record on cve.org

Description

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.

Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hmongodb

Weaknesses

  • CWE-121 Stack-based Buffer Overflow

Affected Products

ProductVersions
MongoDB ServerMongoDB Inc.
  • 5.0 to before 5.0.4Affected
  • 4.4 through 4.4.28Affected
  • 4.2 to before 4.2.16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.