All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMongodb Bson
APPMongodb1.0.0 – 1.1.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Deserialization
CWE
Related vulnerabilities
CVE-2015-4411HIGH7.5same product
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remot...
CVE-2026-13072CRITICAL9.2PL ✓same vendor
Heap Buffer Overflow w MongoDB (tryb compute) podczas przetwarzania BSON
CVE-2017-15535CRITICAL9.1PL ✓same vendor
MongoDB: podatność w kompresji protokołu sieciowego — DoS i modyfikacja pamięci
CVE-2025-14847HIGH8.7⚠ KEVsame vendor
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by ...
CVE-2026-13055HIGH7.1PL ✓same vendor
MongoDB: DoS poprzez wyrażenie agregacji $_internalIndexKey z compound wildcard index