An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python36Upgrade python3-pygmentsUpgrade python3-pymongoUpgrade python3-scipyUpgrade python-sqlalchemy-docUpgrade python3-wheel-wheelUpgrade python-pymongo-docUpgrade python3-sqlalchemyUpgrade python3-docsUpgrade python3-noseUpgrade python3-wheelUpgrade python-virtualenv-docUpgrade python36-debugUpgrade python3-distroUpgrade python3-bsonUpgrade python3-docutilsUpgrade python36-rpm-macrosUpgrade python3-pymongo-gridfsUpgrade python-nose-docsUpgrade python3-PyMySQLUpgrade python3-virtualenvUpgrade python36-devel | Jun 6, 2025 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-pymongoUpgrade python-pymongo-debugsourceUpgrade python3-bson-debuginfoUpgrade python3-pymongo-debuginfoUpgrade python3-pymongo-gridfsUpgrade python-pymongo-debuginfoUpgrade python-pymongo-docUpgrade python3-bson | Mar 10, 2025 | Jun 5, 2024 |
| Debian | — | Upgrade pymongo | Jun 18, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade python3-bsonUpgrade python3-pygmentsUpgrade python3-wheelUpgrade python36Upgrade python-virtualenv-docUpgrade python-nose-docsUpgrade python3-distroUpgrade python3-virtualenvUpgrade python-pymongo-docUpgrade python3-PyMySQLUpgrade python3-noseUpgrade python3-pymongoUpgrade python36-rpm-macrosUpgrade python3-wheel-wheelUpgrade python36-debugUpgrade python3-sqlalchemyUpgrade python3-docsUpgrade python3-scipyUpgrade python36-develUpgrade python3-pymongo-gridfsUpgrade python3-docutilsUpgrade python-sqlalchemy-doc | Jun 5, 2025 | Jun 5, 2024 |
| Redhat_linux | — | Upgrade python3-PyMySQLUpgrade python3-docsUpgrade python3-scipyUpgrade python3-bson-debuginfoUpgrade python3-scipy-debuginfoUpgrade python36-develUpgrade python-pymongo-docUpgrade python3-pymongoUpgrade python36No solution existsUpgrade python3-docutilsUpgrade python3-sqlalchemyUpgrade python3-wheelUpgrade python3-wheel-wheelUpgrade python3-noseUpgrade python3-virtualenvUpgrade python-sqlalchemy-docUpgrade scipy-debugsourceUpgrade python3-pygmentsUpgrade python3-pymongo-gridfsUpgrade python36-debugUpgrade python-pymongo-debuginfoUpgrade python36-rpm-macrosUpgrade python3-distroUpgrade python3-pymongo-debuginfoUpgrade python-virtualenv-docUpgrade python-nose-docsUpgrade python3-bsonUpgrade python-pymongo-debugsource | Jun 5, 2025 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade python-pymongo-debugsourceUpgrade python36-debugUpgrade python3-pymongo-gridfsUpgrade python3-bsonUpgrade scipy-debugsourceUpgrade python3-pymongo-debuginfoUpgrade python-pymongo-debuginfoUpgrade python3-pymongoUpgrade python3-bson-debuginfoUpgrade python3-scipy-debuginfoUpgrade python3-sqlalchemyUpgrade python3-scipyUpgrade python36-develUpgrade python36 | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade python-bson-ext (Ubuntu Pro)Upgrade python3-bson-ext (Ubuntu Pro)Upgrade python3-bson (Ubuntu Pro)Upgrade python3-bson-extUpgrade python-bson (Ubuntu Pro)Upgrade python3-bson | Jul 23, 2024 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub