Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service (MongoDB MongoDB Server)
En bref
- Source
- NVD
- EPSS
- EPSS 0.40 % · centile 34 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mongodb
- Statut NVD
- Analyzed
Rechercher sur…
Description
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.
Faiblesses (CWE)
- CWE-770 — Allocation de ressources sans limite ni régulation
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | mongodb |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | mongodb |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · cna@mongodb.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-72941
- GCVE · GCVE-0-2026-82054
Avis du CERT-FR
- CERTFR-2026-AVI-1157 — Multiples vulnérabilités dans MongoDB Server · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.41cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.30cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 8.2.0 ≤ 8.2.12cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.9cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*
Produits affectés
| Produit | Versions |
|---|---|
| MongoDB · MongoDB Server | affected 8.3.0 < 8.3.9 ; affected 8.0.0 < 8.0.30 ; affected 7.0.0 < 7.0.41 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |