CVE-2019-20925
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.48%
- CWE
- CWE-839
- Published
- 2020-11-24
- Last modified
- 2026-03-14
Affected products
- MongoDB Inc. MongoDB Server
- MongoDB Inc. MongoDB Server
- MongoDB Inc. MongoDB Server
- MongoDB Inc. MongoDB Server
Weakness type
Related vulnerabilities
- CVE-2026-56968 — GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the...
- CVE-2026-48840 — Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading...
- CVE-2023-0425 — Buffer overflow in global memory region