Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-x5xf-rwjm-436w

Опубликовано: 12 июн. 2026
Источник: github
Github: Не прошло ревью
CVSS4: 8.7
CVSS3: 8.8

Описание

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

EPSS

Процентиль: 31%
0.00384
Низкий

8.7 High

CVSS4

8.8 High

CVSS3

Дефекты

CWE-416
CWE-787

Связанные уязвимости

CVSS3: 8.8
ubuntu
3 месяца назад

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

CVSS3: 8.8
nvd
3 месяца назад

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

CVSS3: 8.8
debian
3 месяца назад

A use-after-free vulnerability exists in MongoDB Server's server-side ...

EPSS

Процентиль: 31%
0.00384
Низкий

8.7 High

CVSS4

8.8 High

CVSS3

Дефекты

CWE-416
CWE-787