An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| mongodb | mongodb | 7.0.0 – < 7.0.41 | |
| MongoDB | MongoDB Server | 8.3.0 – < 8.3.9, 8.0.0 – < 8.0.30, 7.0.0 – < 7.0.41 |
cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 7.0.0 < 7.0.41cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 8.0.0 < 8.0.30cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 8.2.0 < 8.2.13cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 8.3.0 < 8.3.9cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.