MongoDB
Page 3 of 4 — MongoDB CVEs from a corpus of 308, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12100 | High | 7.8 | 2025-10-23 | Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1… |
CVE-2025-11575 | High | 7.8 | 2025-10-23 | Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC d… |
CVE-2025-11979 | Medium | 5.3 | 2025-10-20 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under… |
CVE-2025-11695 | High | 8.0 | 2025-10-13 | When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3… |
CVE-2025-10061 | Medium | 6.5 | 2025-09-05 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of… |
CVE-2025-10060 | Medium | 6.5 | 2025-09-05 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and serve… |
CVE-2025-10059 | Medium | 6.5 | 2025-09-05 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided i… |
CVE-2025-7259 | Medium | 6.5 | 2025-07-07 | An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can… |
CVE-2025-6714 | High | 7.5 | 2025-07-07 | MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured… |
CVE-2025-6713 | High | 7.7 | 2025-07-07 | An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCu… |
CVE-2025-6712 | Medium | 6.5 | 2025-07-07 | MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in… |
CVE-2025-6711 | Medium | 4.4 | 2025-07-07 | An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered… |
CVE-2025-6710 | High | 7.5 | 2025-06-26 | MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recu… |
CVE-2025-6709 | High | 7.5 | 2025-06-26 | The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentic… |
CVE-2025-6707 | Medium | 4.2 | 2025-06-26 | Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This… |
CVE-2025-6706 | Medium | 5.0 | 2025-06-26 | An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have author… |
CVE-2025-40906 | Critical | 9.8 | 2025-05-16 | BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790… |
CVE-2025-3085 | High | 8.1 | 2025-04-01 | A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the in… |
CVE-2025-3084 | Medium | 6.5 | 2025-04-01 | When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. Th… |
CVE-2025-3083 | High | 7.5 | 2025-04-01 | Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connecti… |
CVE-2025-3082 | Low | 3.1 | 2025-04-01 | A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. T… |
CVE-2025-0755 | High | 8.4 | 2025-03-18 | The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final… |
CVE-2025-1756 | High | 7.5 | 2025-02-27 | mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated pr… |
CVE-2025-1755 | High | 7.5 | 2025-02-27 | MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with ele… |
CVE-2025-1693 | Low | 3.9 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control charac… |
CVE-2025-1692 | Medium | 6.3 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text… |
CVE-2025-1691 | High | 7.6 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocomplet… |
CVE-2024-10921 | Medium | 6.8 | 2024-11-14 | An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malfo… |
CVE-2024-8013 | Low | 2.2 | 2024-10-28 | A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to… |
CVE-2024-8305 | Medium | 6.5 | 2024-10-21 | prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple… |
CVE-2024-8654 | Medium | 5.0 | 2024-09-10 | MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This i… |
CVE-2024-8207 | Medium | 6.4 | 2024-08-27 | In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a uninte… |
CVE-2024-6384 | Medium | 5.3 | 2024-08-13 | "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterpri… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2024-6382 | Medium | 6.4 | 2024-07-02 | Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application be… |
CVE-2024-6381 | Medium | 4.0 | 2024-07-02 | The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative o… |
CVE-2024-6376 | High | 7.0 | 2024-07-01 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectio… |
CVE-2024-6375 | Medium | 5.4 | 2024-07-01 | A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degra… |
CVE-2024-5629 | Medium | 4.7 | 2024-06-05 | An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception whic… |
CVE-2024-3374 | Medium | 5.3 | 2024-05-14 | An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exce… |
CVE-2024-3372 | High | 7.5 | 2024-05-14 | Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause u… |
CVE-2024-3371 | High | 7.1 | 2024-04-24 | MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including… |
CVE-2024-1351 | High | 8.8 | 2024-03-07 | Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to su… |
CVE-2023-0437 | Medium | 5.3 | 2024-01-12 | When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All Mo… |
CVE-2023-0436 | Medium | 4.5 | 2023-11-07 | The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBU… |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2023-1409 | Medium | 5.3 | 2023-08-23 | If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely… |
CVE-2023-4009 | High | 7.2 | 2023-08-08 | In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access t… |
CVE-2023-0342 | Low | 3.1 | 2023-06-09 | MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This iss… |
CVE-2022-48282 | Medium | 6.6 | 2023-02-21 | Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause… |
CVE-2022-24272 | Medium | 6.5 | 2022-04-21 | An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mong… |
CVE-2021-32040 | Medium | 6.5 | 2022-04-12 | It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of t… |
CVE-2021-32036 | Medium | 5.4 | 2022-02-04 | An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource dep… |
CVE-2021-32039 | Medium | 5.5 | 2022-01-20 | Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credential… |
CVE-2021-20330 | Medium | 6.5 | 2021-12-15 | An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potentia… |
CVE-2021-32037 | Medium | 6.5 | 2021-11-24 | An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually… |
CVE-2021-20332 | Medium | 4.2 | 2021-08-02 | Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted w… |
CVE-2021-20333 | Medium | 5.3 | 2021-07-23 | Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects… |
CVE-2021-20329 | Medium | 6.8 | 2021-06-10 | Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object wi… |
CVE-2021-20331 | Medium | 4.2 | 2021-05-13 | Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an applica… |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2020-7924 | Medium | 4.2 | 2021-04-12 | Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certif… |
CVE-2021-20334 | Medium | 4.8 | 2021-04-06 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the use… |
CVE-2018-25004 | Medium | 4.9 | 2021-03-01 | A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affec… |
CVE-2020-7929 | Medium | 6.5 | 2021-03-01 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong… |
CVE-2021-20328 | Medium | 6.4 | 2021-02-25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s… |
CVE-2021-20327 | Medium | 6.4 | 2021-02-25 | A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in c… |
CVE-2021-20335 | Medium | 6.7 | 2021-02-11 | For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the u… |
CVE-2019-20925 | High | 7.5 | 2020-11-24 | An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectl… |
CVE-2020-7927 | High | 8.1 | 2020-11-23 | Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue… |
CVE-2018-20803 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics proces… |
CVE-2020-7928 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects M… |
CVE-2019-2393 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue… |
CVE-2019-2392 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negat… |
CVE-2019-20924 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsB… |
CVE-2019-20923 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions c… |
CVE-2018-20805 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affe… |
CVE-2018-20804 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Serve… |
CVE-2018-20802 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner… |
CVE-2020-7926 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server select… |
CVE-2020-7925 | High | 7.5 | 2020-11-23 | Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially craf… |
CVE-2020-7923 | Medium | 6.5 | 2020-08-21 | A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsyst… |
CVE-2019-2388 | Medium | 5.8 | 2020-05-13 | In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager in… |
CVE-2020-7921 | Medium | 4.6 | 2020-05-06 | Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to by… |
CVE-2020-12135 | Medium | 5.5 | 2020-04-24 | bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter byt… |
CVE-2020-7922 | Medium | 6.4 | 2020-04-09 | X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to Mongo… |
CVE-2019-2391 | Medium | 4.2 | 2020-03-31 | Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data di… |
CVE-2020-7610 | Critical | 9.8 | 2020-03-30 | All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leadi… |
CVE-2015-4411 | High | 7.5 | 2020-02-20 | The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker… |
CVE-2019-2390 | High | 8.2 | 2019-08-30 | An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with M… |
CVE-2019-2389 | Medium | 5.3 | 2019-08-30 | Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to b… |
CVE-2019-2386 | High | 7.1 | 2019-08-06 | After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflate… |
CVE-2015-7882 | High | 8.1 | 2019-07-19 | Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access. |
CVE-2018-16790 | High | 8.1 | 2018-09-10 | _bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafte… |
CVE-2018-13863 | High | 7.5 | 2018-07-10 | The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS)… |
CVE-2017-2665 | Medium | 4.8 | 2018-07-06 | The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is… |
CVE-2017-15535 | Critical | 9.1 | 2017-11-01 | MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression)… |
CVE-2017-14227 | High | 7.5 | 2017-09-09 | In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to… |
CVE-2014-8180 | Medium | 5.5 | 2017-06-06 | MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial… |
CVE-2016-3104 | High | 7.5 | 2017-04-14 | mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by… |