MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories

MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories

Accessing Untrusted Directory May Allow Local Privilege Escalation

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run…

Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service

Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members

Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination

Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

MD5 checksum creation may cause availability loss

Memory safety issues in slot-based execution hash table spill

Mongod can run out of stack memory when expressions create deeply nested documents

An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

Connections received from the proxy port may not count towards total accepted connections

MongoDB Server may crash when inserting large documents

MongoDB may be susceptible to Invariant Failure due to batched delete

Configuration may unexpectedly disable certificate validation

MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections

Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB

Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication

Malformed MongoDB wire protocol messages may cause mongos to crash

MongoDB C Driver bson library may be susceptible to buffer overflow

MongoDB Server may have unexpected application behaviour due to invalid BSON

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms…

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used…

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause…

In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of…

mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory…

Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

Shell script injection via server-supplied database name in Open MongoDB shell

Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure

Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure

Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption