Total 149 security vulnerabilities recorded for mongodb software and firmware.
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects a...
The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for B...
A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable...
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the ...
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory iss...
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup...
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index....
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints....
Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only....
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash....
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursiv...
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connecti...
Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This co...
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue af...
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data incon...
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistaken...
A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. Thi...
Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert fa...
Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extend...
A mongoc_bulk_operation_t may read invalid memory if large options are passed....
The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later rea...
An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issue...
When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions pr...