Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-r8cx-9wfm-r3m7

Опубликовано: 13 мая 2026
Источник: github
Github: Не прошло ревью
CVSS4: 6.1
CVSS3: 6.4

Описание

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.

This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.

This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

EPSS

Процентиль: 3%
0.00129
Низкий

6.1 Medium

CVSS4

6.4 Medium

CVSS3

Дефекты

CWE-416

Связанные уязвимости

CVSS3: 6.4
ubuntu
3 месяца назад

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS3: 6.4
nvd
3 месяца назад

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS3: 6.4
debian
3 месяца назад

A use-after-free vulnerability exists in MongoDB's Field-Level Encrypt ...

EPSS

Процентиль: 3%
0.00129
Низкий

6.1 Medium

CVSS4

6.4 Medium

CVSS3

Дефекты

CWE-416