Vulnerabilities > CVE-2021-32040 - Out-of-bounds Write vulnerability in Mongodb

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

mongodb

CWE-787

NVD

Published: 2022-04-12

Updated: 2024-09-16

Summary

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16. Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.

Vulnerable Configurations

Part	Description	Count
Application	Mongodb Mongodb Mongodb 5.0.0 Mongodb Mongodb 5.0.1 Mongodb Mongodb 5.0.2 Mongodb Mongodb 5.0.3 Mongodb Mongodb 4.4.0 Mongodb Mongodb 4.4.1 Mongodb Mongodb 4.4.2 Mongodb Mongodb 4.4.3 Mongodb Mongodb 4.4.4 Mongodb Mongodb 4.4.5 Mongodb Mongodb 4.4.6 Mongodb Mongodb 4.4.7 Mongodb Mongodb 4.4.8 Mongodb Mongodb 4.4.9 Mongodb Mongodb 4.4.10 Mongodb Mongodb 4.2.0 Mongodb Mongodb 4.2.1 Mongodb Mongodb 4.2.2 Mongodb Mongodb 4.2.3 Mongodb Mongodb 4.2.4 Mongodb Mongodb 4.2.5 Mongodb Mongodb 4.2.6 Mongodb Mongodb 4.2.7 Mongodb Mongodb 4.2.8 Mongodb Mongodb 4.2.9 Mongodb Mongodb 4.2.10 Mongodb Mongodb 4.2.11 Mongodb Mongodb 4.2.12 Mongodb Mongodb 4.2.13 Mongodb Mongodb 4.2.14 Mongodb Mongodb 4.2.15	79

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References