MongoDB Server -- Multiple vulnerabilities

https://jira.mongodb.org/browse/SERVER-119981 reports: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. An authorization flaw in the user management command could allow an authenticated user to make limited changes t...

CVE-2026-6231

The bsonvalidate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that re...

Ubuntu: Security Advisory (USN-8064-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-MONGODB-2025-13507 Time-series operations may cause internal BSON size limit to be exceed

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8...

FreeBSD : MongoDB -- Reachable Assertion (e72ec9c1-ced4-11f0-a958-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e72ec9c1-ced4-11f0-a958-b42e991fc52e advisory. https://jira.mongodb.org/browse/SERVER-101180 reports: MongoDB Server may experience an invariant failu...

FreeBSD : MongoDB -- Improper Validation of Specified Quantity in Input (ea64d2ec-ced4-11f0-a958-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ea64d2ec-ced4-11f0-a958-b42e991fc52e advisory. https://jira.mongodb.org/browse/SERVER-108565 reports: Inconsistent object size validation in time seri...

CVE-2025-13507 Time-series operations may cause internal BSON size limit to be exceed

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8...

Linux Distros Unpatched Vulnerability : CVE-2015-1609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request. CVE-2015-1609 No...

The vulnerability of the MongoDB database management system lies in improper handling of zero bytes during BSON data processing. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the MongoDB database management system server is related to improper elimination of zero bytes. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures by sending specially crafted queries...

DEBIAN-CVE-2024-5629

An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory...

UBUNTU-CVE-2024-3374

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions...

SUSE CVE-2015-1609

MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request...

The vulnerability of the _bsotype function in the BSON parsing software package allows a hacker to execute arbitrary code.

The vulnerability of the bsotype function in the BSON parsing software package is related to errors during data deserialization. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

DEBIAN-CVE-2019-2391

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to...

DEBIAN-CVE-2020-7610

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type...

DEBIAN-CVE-2018-13863

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...

PostgreSQL json or jsonb Data Denial of Service Vulnerability

PostgreSQL is an object-relational database management system that supports an extended subset of SQL standards. A security vulnerability exists in PostgreSQL that can be exploited by remote attackers to submit special json or jsonb data to crash the target service...

RubyGems BSON Denial of Service Vulnerability (CNVD-2015-03762)

RubyGems or gems for short is a Ruby packaging system for packaging Ruby components. A denial of service vulnerability exists in RubyGems BSON. This vulnerability allows attackers to launch denial of service attacks...

RubyGems BSON Denial of Service Vulnerability

RubyGems or gems for short is a Ruby packaging system for packaging Ruby components. A denial of service vulnerability exists in RubyGems BSON. This vulnerability allows attackers to launch denial of service attacks...