repository icon
mongodb / mongo-python-driver Project repository

PyMongo - the Official MongoDB Python driver

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN6 DAYS

FIX

WITHINN/A DAYS

Heap-buffer-overflow READ in bson._cbson._array_of_documents_to_buffer via attac...
eunhokim98
self closed
Arbitrary Code Execution via Unvalidated Binary Path in mongocryptdSpawnArgs
shu4ya
self closed
Unbounded Decompression in Wire Protocol Causes OOM DoS
willardjansen
duplicate
High
BSON negative document size bypasses bounds check in decode_all() causing crash
snakeyworm
duplicate
High
Arbitrary file read via unvalidated token file paths in OIDC authentication call...
snakeyworm
duplicate
Medium
Unauthenticated Local File Existence Oracle and Metadata Tampering via TLS Confi...
l3tchupkt
pending
Arbitrary Local File Read and Credential Exfiltration via OIDC Provider Environm...
l3tchupkt
duplicate
High
Universal Uncontrolled Recursion Hardening in BSON and JSON Stack leading to Den...
joel-66
pending
Arbitrary Command Execution in PyMongo Daemon Spawning
joel-66
pending
Segmentation Fault in PyMongo C-Extension via Uncontrolled Recursion bypassing P...
joel-66
pending
Unbounded decompression of OP_COMPRESSED responses (malicious-server DoS)
kotori2
duplicate
High
Denial of Service via Decompression Bomb in OP_COMPRESSED Wire Protocol
snailsploit
duplicate
None
Out-of-Bounds Heap Read in BSON Binary (Type 5) Deserialization via Incomplete B...
snailsploit
pending
Pre-Auth SSRF in PyMongo via unvalidated OCSP fetches during TLS handshake
ibfavas
pending
Heap Buffer Over-Read in C Extension BSON Binary Parsing (CWE-125)
eistee82
duplicate
Medium
BSON negative document size bypasses bounds check in decode_all() causing crash
wormysnake
duplicate
High
Arbitrary file read via unvalidated token file paths in OIDC authentication call...
wormysnake
pending
NoSQL Injection in GridFSBucket.delete_by_name() and rename_by_name()
1-5pool
pending
Out-of-bounds heap read in BSON Binary (Type 5) deserialization
arozanov
duplicate
Medium
Multiple Out-of-Bounds Reads (CWE-125) in BSON C-Extension via Unbounded strlen...
thejasrajamoney
pending
[CRITICAL] Remote Code Execution (RCE) via Unsanitized mongocryptd_spawn_path in...
thejasrajamoney
pending
MongoClient.__repr__() Leaks TLS Key Passphrase and AWS Session Token Despite In...
twsky100
duplicate
Critical
[HIGH] Out-of-bounds Read in BSON Array Decoding due to Flawed Bounds Calculatio...
thejasrajamoney
duplicate
High
BSON Boolean Decode Missing Bounds Check Causes Heap Over-Read in C Extension
nhomyk
pending
MongoClient.__repr__() Leaks TLS Key Passphrase and AWS Session Token Despite In...
skyflocka
duplicate
High
Predictable Wire Protocol Request IDs via Mersenne Twister PRNG
nhomyk
pending
MongoClient.__repr__() leaks tlscertificatekeyfilepassword and AWS_SESSION_TOKEN
skyflocka
self closed
Heap Buffer Over-Read in BSON C Extension Binary Element (type 0x05) Decoding
skyflocka
duplicate
High
Heap Out-of-Bounds Read in _array_of_documents_to_buffer via crafted BSON embedd...
theglitch3k
duplicate
High
Out-of-bounds Read (CWE-125) in bson/_cbsonmodule.c during type 0x05 (Binary) de...
kimngocchung
duplicate
High
Use-After-Free in bson/_cbsonmodule.c write_dict() via unpinned PyDict_Next borr...
kimngocchung
pending
[CWE-125] Out-of-Bounds Read via strlen() without prior bounds check when decodi...
shima-coder
duplicate
High
MongoCredential Exposes Plaintext Password via repr()
nandhuguru
pending
CommandFailedEvent Leaks Sensitive Authentication Data
nandhuguru
pending
Unbounded Decompression (Compression Bomb) — Denial of Service
nandhuguru
duplicate
Medium
[CWE-125] Heap Buffer Over-Read in _cbson_array_of_documents_to_buffer Due to Mi...
shima-coder
duplicate
Medium
PyMongo raw batch BSON parsing out-of-bounds read
finder16
pending
Heap Buffer Over-Read in BSON Binary Type Decoding in C Extension (`_cbsonmodule...
s3zer0
duplicate
Medium
Out-of-bounds read in C BSON binary decoding (`type=0x05`, subtype 0) leaks memo...
maru1009
duplicate
Critical
Case-sensitive command name check allows redaction bypass in PyMongo command log...
4ur0n
pending
Authentication Bypass in PyMongo OIDC via Cached Authenticator Reuse Without ALL...
4ur0n
pending
HTTP parameter injection via unencoded client_id in Azure IMDS token request in...
hax1ng
pending
Decompression bomb denial of service via missing post-decompression size validat...
hax1ng
duplicate
Medium
Out-of-bounds heap read in BSON binary (type 0x05) deserialization in bson/_cbso...
hax1ng
pending
Pre-Auth Blind SSRF via Unvalidated OCSP Responder URIs in TLS Certificates
mertsatilmaz
duplicate
Medium
URL Parameter Injection in Azure IMDS Token Request via Unencoded client_id in _...
seonghoj-bright
duplicate
High
OIDC Auth Property Injection via Delimiter Smuggling in authMechanismProperties...
seonghoj-bright
pending
OIDC Authentication Property Injection via Delimiter Smuggling in authMechanismP...
seonghoj-bright
self closed
URL Parameter Injection in Azure IMDS Token Request via Unencoded client_id in _...
seonghoj-bright
self closed
Insecure Deserialization in BSON/JSON processing leading to Remote Code Executio...
sebas5207418
pending
Improper Access Control: Unvalidated mongocryptd_uri Parameter Allows Unauthoriz...
akhmittra
pending
Cloud Metadata Service Exposure via Azure and GCP Authentication Helpers
akhmittra
pending
Server-Side Request Forgery (SSRF) via mongocryptd_uri Parameter in AutoEncrypti...
akhmittra
self closed
Command Injection via mongocryptd_spawn_path and mongocryptd_spawn_args in AutoE...
akhmittra
pending
SSRF via Unvalidated OCSP URI in Certificate Authority Information Access (AIA)
222n5
pending
Critical Double Free in BSON C Extension during Reallocation Failure
222n5
pending
Title: Denial of Service via Unbounded Document Creation in GridFS due to Missin...
222n5
pending
Remote Denial of Service in PyMongo via Unhandled ValueError in SCRAM Parsing
shahanash
pending
Signed Integer Overflow in PyMongo _cmessage OP_MSG Construction Leading to Memo...
hyperps
pending
SSRF via URL Parameter Injection in Azure OIDC Authentication (client_id not URL...
cr-itamarhershko
pending
Critical Validation Failures in BSON Binary Vector Implementation (Subtype 9) En...
spaceleam
pending
Path Traversal via Unvalidated Tar Extraction in .evergreen/scripts/setup_tests....
adityashirsatrao007
pending
Uncontrolled Resource Consumption via Compression (Zip Bomb)
daddyjamwal
pending
Deprecated TLS Protocol Support (TLS 1.0/1.1 Not Explicitly Disabled)
1bdool492
self closed
Undocumented Implicit OCSP Disabling via tlsAllowInvalidCertificates
7908837174
pending
Command Injection via Unsanitized Environment Variables in Test Setup Scripts
al-cybision
duplicate
High
Zstandard Decompression Denial of Service (DoS) - Resource Exhaustion
joelindra
pending
Command Injection in Evergreen CI/CD Configuration
hope4real
pending
[High Severity] Path Traversal via Unvalidated Tar Extraction in mongo-python-dr...
captain-n3m0
pending
huntr: mongodb/mongo-python-driver