Description
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
References (3)
Core 3
Core References
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00007.html
Issue Tracking, Patch, Third Party Advisory release-notes
https://jira.mongodb.org/browse/PYTHON-4305
Scores
CVSS v3
4.7
EPSS
0.0009
EPSS Percentile
26.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (3)
debian/debian_linux
10.0
mongodb/pymongo
< 4.6.3
pypi/pymongo
0 - 4.6.3PyPI
Published
Jun 05, 2024
Tracked Since
Feb 18, 2026