Mongodb C Driver
Monthly
Heap buffer overflow in MongoDB C Driver's Cyrus SASL integration allows local attackers to achieve code execution before authentication by providing a maliciously crafted username in a MongoDB URI with GSSAPI authentication. The vulnerability triggers during username canonicalization via unsafe string copying, requiring no privileges or user interaction. Exploitable against any application using the affected driver that processes untrusted MongoDB connection strings. No active exploitation confirmed (not in CISA KEV). EPSS data not provided. Vendor has acknowledged the issue via JIRA tracking (CDRIVER-6134).
Crash-inducing denial-of-service in the MongoDB C Driver (all versions before 2.2.3) allows a network-privileged adversary - either a compromised third-party cloud server the application trusts or a man-in-the-middle attacker on the network path - to crash the consuming application by delivering a malformed HTTP response. The vulnerability carries a CVSS 4.0 score of 2.0 due to high attack complexity, prerequisite network positioning, and impact limited strictly to low availability on the vulnerable system. No public exploit code exists and EPSS probability sits at 0.03% (8th percentile), indicating negligible observed exploitation activity at time of analysis.
Heap buffer overflow in MongoDB C Driver's Cyrus SASL integration allows local attackers to achieve code execution before authentication by providing a maliciously crafted username in a MongoDB URI with GSSAPI authentication. The vulnerability triggers during username canonicalization via unsafe string copying, requiring no privileges or user interaction. Exploitable against any application using the affected driver that processes untrusted MongoDB connection strings. No active exploitation confirmed (not in CISA KEV). EPSS data not provided. Vendor has acknowledged the issue via JIRA tracking (CDRIVER-6134).
Crash-inducing denial-of-service in the MongoDB C Driver (all versions before 2.2.3) allows a network-privileged adversary - either a compromised third-party cloud server the application trusts or a man-in-the-middle attacker on the network path - to crash the consuming application by delivering a malformed HTTP response. The vulnerability carries a CVSS 4.0 score of 2.0 due to high attack complexity, prerequisite network positioning, and impact limited strictly to low availability on the vulnerable system. No public exploit code exists and EPSS probability sits at 0.03% (8th percentile), indicating negligible observed exploitation activity at time of analysis.