CVE-2024-10921

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

HIGH

8.1

CVSS Score

Published: November 14, 2024 at 04:04 PM UTC

Updated: June 17, 2026 at 06:56 AM UTC

1 product affected across 1 vendorMongoDB

Using MongoDB Server by MongoDB Inc?

Get instant alerts when new vulnerabilities affect MongoDB Server - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

MongoDB · MongoDB

95%

5.0 ≤ v < 5.0.305.0.0 ≤ v < 5.0.306.0 ≤ v < 6.0.196.0.0 ≤ v < 6.0.197.0 ≤ v < 7.0.157.0.0 ≤ v < 7.0.158.0 ≤ v < 8.0.38.0.0 ≤ v < 8.0.35.0 5.0.0 5.0.1 5.0.10 5.0.11 5.0.12 5.0.13 5.0.14 5.0.15 5.0.16 5.0.17 5.0.18 5.0.19 5.0.2 5.0.20 5.0.21 5.0.22 5.0.23 5.0.24 5.0.25 5.0.26 5.0.27 5.0.28 5.0.29 5.0.3 5.0.4 5.0.5 5.0.6 5.0.7 5.0.8 5.0.9 6.0 6.0.0 6.0.1 6.0.10 6.0.11 6.0.12 6.0.13 6.0.14 6.0.15 6.0.16 6.0.17 6.0.18 6.0.2 6.0.3 6.0.4 6.0.5 6.0.6 6.0.7 6.0.8 6.0.9 7.0 7.0.0 7.0.1 7.0.10 7.0.11 7.0.12 7.0.13 7.0.14 7.0.2 7.0.3 7.0.4 7.0.5 7.0.6 7.0.7 7.0.8 7.0.9 8.0 8.0.0 8.0.1 8.0.2

Affected range stops below 5.0.30, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.19, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.0.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.0.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://jira.mongodb.org/browse/SERVER-96419

References (1)

Issue TrackingVendor Advisory

Source: [email protected]

https://jira.mongodb.org/browse/SERVER-96419

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-158

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card