Skip to main content

Improper Neutralization of Null Byte or NUL Character

CVE-2024-10921

High
8.1/10

Summary

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server versions r5.0.x prior to 5.0.30, r6.0.x prior to 6.0.19, r7.0.x prior to 7.0.15 and r8.0.x prior to 8.0.3.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-158 - Improper Neutralization of Null Byte or NUL Character

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

References

Advisory Timeline

  • Published