CVE-2024-3374

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-3374
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-3374.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-3374
Aliases
Downstream
Published
2024-05-14T13:26:42.389Z
Modified
2026-05-15T04:08:02.109958450Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
MongoDB Server (mongod) may crash when generating ftdc
Details

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "5.0"
                },
                {
                    "last_affected": "5.0.16"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "last_affected": "6.0.5"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3374.json",
    "cna_assigner": "mongodb"
}
References

Affected packages