An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-sqlalchemyUpgrade python3-pygmentsUpgrade python3-pymongoUpgrade python-pymongo-docUpgrade python3-wheel-wheelUpgrade python-sqlalchemy-docUpgrade python3-scipyUpgrade python3-docsUpgrade python36Upgrade python36-debugUpgrade python36-develUpgrade python3-virtualenvUpgrade python36-rpm-macrosUpgrade python3-noseUpgrade python3-bsonUpgrade python3-pymongo-gridfsUpgrade python-nose-docsUpgrade python3-docutilsUpgrade python3-wheelUpgrade python3-PyMySQLUpgrade python-virtualenv-docUpgrade python3-distro | Jun 6, 2025 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-pymongo-debuginfoUpgrade python3-bson-debuginfoUpgrade python3-pymongoUpgrade python-pymongo-debugsourceUpgrade python-pymongo-docUpgrade python3-bsonUpgrade python-pymongo-debuginfoUpgrade python3-pymongo-gridfs | Mar 10, 2025 | Jun 5, 2024 |
| Debian | — | Upgrade pymongo | Jun 18, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade python3-pymongoUpgrade python-virtualenv-docUpgrade python3-distroUpgrade python-nose-docsUpgrade python36-rpm-macrosUpgrade python-sqlalchemy-docUpgrade python3-pymongo-gridfsUpgrade python3-docutilsUpgrade python3-sqlalchemyUpgrade python3-pygmentsUpgrade python3-bsonUpgrade python3-scipyUpgrade python3-wheelUpgrade python3-docsUpgrade python36-develUpgrade python3-noseUpgrade python3-PyMySQLUpgrade python3-virtualenvUpgrade python36Upgrade python36-debugUpgrade python3-wheel-wheelUpgrade python-pymongo-doc | Jun 5, 2025 | Jun 5, 2024 |
| Redhat_linux | — | Upgrade python36-develUpgrade python-sqlalchemy-docUpgrade python3-bson-debuginfoUpgrade python3-PyMySQLUpgrade scipy-debugsourceUpgrade python-pymongo-docUpgrade python3-noseUpgrade python3-pymongoUpgrade python3-scipyUpgrade python3-scipy-debuginfoUpgrade python3-docutilsUpgrade python36Upgrade python3-wheelUpgrade python3-wheel-wheelUpgrade python3-virtualenvUpgrade python3-docsNo solution existsUpgrade python3-sqlalchemyUpgrade python3-pymongo-debuginfoUpgrade python36-debugUpgrade python36-rpm-macrosUpgrade python3-distroUpgrade python3-bsonUpgrade python3-pygmentsUpgrade python-pymongo-debugsourceUpgrade python-pymongo-debuginfoUpgrade python3-pymongo-gridfsUpgrade python-nose-docsUpgrade python-virtualenv-doc | Jun 5, 2025 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade python3-scipyUpgrade python3-scipy-debuginfoUpgrade python36Upgrade python3-pymongoUpgrade python3-sqlalchemyUpgrade python-pymongo-debuginfoUpgrade python36-develUpgrade python3-bson-debuginfoUpgrade python3-bsonUpgrade python3-pymongo-debuginfoUpgrade python3-pymongo-gridfsUpgrade python36-debugUpgrade python-pymongo-debugsourceUpgrade scipy-debugsource | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade python-bson-ext (Ubuntu Pro)Upgrade python3-bson (Ubuntu Pro)Upgrade python3-bson-ext (Ubuntu Pro)Upgrade python3-bson-extUpgrade python3-bsonUpgrade python-bson (Ubuntu Pro) | Jul 23, 2024 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub