CVE-2025-0755

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0755
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-0755.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-0755
Aliases
Downstream
Published
2025-03-18T09:01:04.793Z
Modified
2026-05-08T12:27:49.809267Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
MongoDB C Driver bson library may be susceptible to buffer overflow
Details

The various bsonappend functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0755.json",
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-122"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "1.27.5"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.0.1"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.0.16"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo-c-driver

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo-c-driver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
01decf26c18b1b89d97d3b55317910a3460741ae
Database specific 
{
    "cpe": "cpe:2.3:a:mongodb:libbson:*:*:*:*:*:*:*:*",
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.27.5"
        }
    ]
}

Affected versions

0.*
0.90.0
0.92.0
0.92.2
0.94.0
0.94.2
0.96.0
0.96.4
0.98.0
0.98.2
1.*
1.0.0
1.0.2
1.1.0
1.1.0-rc0
1.1.10
1.1.11
1.1.2
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.11.0
1.27.0
1.27.1
1.27.2
1.27.3
1.27.4
1.3.0
1.3.0-rc0
1.4.0-beta1
1.5.0-rc0
1.5.0-rc1
1.5.0-rc2
1.5.0-rc3
1.5.0-rc4
1.6.0
1.6.0-rc0
1.7.0-rc0
1.9.0-rc0
1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-0755.json"