GHSA-x24v-h3xm-qf9x: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using the MongoDB C# Driver's BSON library are exposed if they deserialize untrusted BSON or JSON content. MongoDB server components are not affected.
What access does an attacker need to exploit it?
An attacker does not need authentication or user interaction, but must be able to cause the application to deserialize attacker-controlled content. Exploitation relies on repeatedly supplying content that drives retained data growth in the process.
What is the expected impact of successful exploitation?
The impact is exhaustion of the host application's available memory, which can deny service. The provided impact assessment indicates no confidentiality or integrity impact.
What remediation information is available?
A MongoDB C# Driver release reference is provided for version v3.13.0. The supplied data does not specify affected versions, fixed-version applicability, or compensating controls for environments that cannot patch immediately.