CVE-2019-20925CWE-839

Denial of service via malformed network packet

High · published November 24, 2020

CVSS v3.1
7.5
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01676 · 76.7th percentile
Weakness
CWE-839 · Numeric Range Comparison Without Minimum Check
Published
2020-11-24T11:00Z
EPSS history
Timeline
  • 24 NOV 11:00Z
    Denial of service via malformed network packet
    cvelistv5