Vulnerability GHSA-m87m-mmvp-v9qm
Medium Risk
MEDIUM RISK
CVSS Score: 4.7
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 years ago
June 05, 2024 at 03:30 PM UTC
PyMongo Out-of-bounds Read in the bson module
0.1pre - 4.6.2
0.1pre - 4.6.2
Summary
PyMongo Out-of-bounds Read in the bson module
Details
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
8 hours ago
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
0.1pre - 4.18.1 GHSA-v4x9-3549-crwv
0.1pre - 4.18.1 GHSA-v4x9-3549-crwv
Medium Risk
8 hours ago
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
3.5.0 - 4.18.1 GHSA-vp6j-j7w5-5xjj
3.5.0 - 4.18.1 GHSA-vp6j-j7w5-5xjj
Medium Risk
8 hours ago
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
3.9.0 - 4.18.1 GHSA-qx36-8mw2-4r3x
3.9.0 - 4.18.1 GHSA-qx36-8mw2-4r3x
Medium Risk
8 hours ago
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
0.1pre - 4.18.0 GHSA-8fvv-fgr5-f8ch
0.1pre - 4.18.0 GHSA-8fvv-fgr5-f8ch
Medium Risk
3 months ago
PyMongo Out-of-bounds Read in the bson module
0.1pre - 4.6.2 PYSEC-2026-1826
0.1pre - 4.6.2 PYSEC-2026-1826
Impacted packages
Timeline
Published
2 years ago
June 05, 2024 at 03:30 PM UTC
Fixed (4.6.3)
2 years ago
March 28, 2024 at 01:22 AM UTC
Last Modified
26 days ago
September 10, 2026 at 03:50 AM UTC