Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service

Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members

Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination

Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

MD5 checksum creation may cause availability loss

Memory safety issues in slot-based execution hash table spill

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available…

Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary

MongoDB Server may experience an invariant failure during batched delete operations when handling documents

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during…

MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data

MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in…

The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which…

Improper validation of certain metadata input may result in the server not correctly serialising BSON

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms…

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used…

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause…

In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of…

mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory…

Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

Shell script injection via server-supplied database name in Open MongoDB shell

Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure

Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure

Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption

Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate…

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts,…

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but…

Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache