CVE-2024-10921

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

State: Published
Severity: 6.8 Medium
Published: Nov 14, 2024
Updated: Nov 15, 2024
Reserved: Nov 6, 2024

Description

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H	mongodb

Weaknesses

CWE-158 Improper Neutralization of Null Byte or NUL Character

Affected Products

Product	Versions
MongoDB ServerMongoDB Inc	5.0 to before 5.0.30Affected 6.0 to before 6.0.19Affected 7.0 to before 7.0.15Affected 8.0 to before 8.0.3Affected

References

https://jira.mongodb.org/browse/SERVER-96419

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.