Unscored severity · published Aug 15, 2013
CVE-2013-2132
bson/_cbsonmodule.c in the mongo-python-driver (aka
–
CVSS
4.1%
EPSS
No
On KEV
Description
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MongoDB · MongoDB
through 2.5.1; 1.2.0; 1.4.0; 1.6.0; 1.8.0; 2.0.0; +8 more · source: NVD
OP
Opensuse · Opensuse
12.3 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 12.10; 13.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2132
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-06/msg00180.html
seclists.org
http://seclists.org/oss-sec/2013/q2/447
Vendor Advisory
http://ubuntu.com/usn/usn-1897-1
www.debian.org
http://www.debian.org/security/2013/dsa-2705
www.osvdb.org
http://www.osvdb.org/93804
More from MongoDB
9.9
CVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability
7.5
CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
9.8
CVE-2026-19001
MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
9.8
CVE-2025-3085
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate…
9.8
CVE-2024-8654
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour