CVE-2024-10921: Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10921?
The severity of CVE-2024-10921 is classified as high due to buffer over-read vulnerabilities that can be triggered by malicious requests.
How do I fix CVE-2024-10921?
To fix CVE-2024-10921, upgrade MongoDB Server to version 5.0.30 or later, or to version 6.0.19 or later.
Which MongoDB Server versions are affected by CVE-2024-10921?
CVE-2024-10921 affects MongoDB Server versions prior to 5.0.30, 6.0.19, 7.0.15, and includes up to 8.0.2.
What kind of attack does CVE-2024-10921 allow?
CVE-2024-10921 allows authorized users to cause crashes or read sensitive data from Server memory through specially crafted BSON requests.
Is my MongoDB version vulnerable to CVE-2024-10921?
Check if your MongoDB version is below 5.0.30, 6.0.19, or 7.0.15, or if you are using up to 8.0.2 to determine vulnerability to CVE-2024-10921.