High severity · published Jul 2, 2024
CVE-2024-6382
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RD
Rust Driver · Mongodb
2.0.0 before 2.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6382
Issue Tracking
https://jira.mongodb.org/browse/RUST-1881
More from Rust Driver
8.3
CVE-2026-88024
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver
7.5
CVE-2025-11695
When tlsInsecure=False appears in a connection string, certificate validation is disabled
6.5
CVE-2026-81526
Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
4.4
CVE-2021-20332
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is…