Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-13066

Опубликовано: 22 июл. 2026
Источник: nvd
CVSS3: 6.5
EPSS Низкий

Описание

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*
Версия от 7.0.0 (включая) до 7.0.39 (исключая)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*
Версия от 8.0.0 (включая) до 8.0.28 (исключая)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*
Версия от 8.2.0 (включая) до 8.2.12 (исключая)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*
Версия от 8.3.0 (включая) до 8.3.7 (исключая)

EPSS

Процентиль: 30%
0.00369
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-843

Связанные уязвимости

CVSS3: 6.5
ubuntu
около 1 месяца назад

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

CVSS3: 6.5
debian
около 1 месяца назад

Improper handling of DBPointer objects during BSON serialization in Mo ...

CVSS3: 6.5
github
около 1 месяца назад

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

EPSS

Процентиль: 30%
0.00369
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-843