{"id":"CVE-2019-20925","state":"PUBLISHED","title":"Denial of service via malformed network packet","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","publishedAt":"2020-11-24T11:00:16.027Z","updatedAt":"2024-09-16T23:45:46.251Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"mongodb"},"assigner":"mongodb","products":["MongoDB Inc. MongoDB Server"],"affected":[{"vendor":"MongoDB Inc.","product":"MongoDB Server","defaultStatus":"unaffected","versions":[{"version":"4.2","status":"affected","lessThan":"4.2.1","versionType":"custom"},{"version":"4.0","status":"affected","lessThan":"4.0.13","versionType":"custom"},{"version":"3.6","status":"affected","lessThan":"3.6.15","versionType":"custom"},{"version":"3.4","status":"affected","lessThan":"3.4.24","versionType":"custom"}]}],"references":["https://jira.mongodb.org/browse/SERVER-43751"],"weaknesses":["CWE-839"],"ingestedAt":"2026-10-29T19:45:50.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/20xxx/CVE-2019-20925.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-20925","state":"PUBLISHED","datePublished":"2020-11-24T11:00:16.027Z","dateUpdated":"2024-09-16T23:45:46.251Z","assignerShortName":"mongodb","assignerOrgId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","dateReserved":"2020-10-06T00:00:00.000Z"},"containers":{"cna":{"title":"Denial of service via malformed network packet","descriptions":[{"lang":"en","value":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24."}],"affected":[{"vendor":"MongoDB Inc.","product":"MongoDB Server","defaultStatus":"unaffected","versions":[{"version":"4.2","status":"affected","lessThan":"4.2.1","versionType":"custom"},{"version":"4.0","status":"affected","lessThan":"4.0.13","versionType":"custom"},{"version":"3.6","status":"affected","lessThan":"3.6.15","versionType":"custom"},{"version":"3.4","status":"affected","lessThan":"3.4.24","versionType":"custom"}]}],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-43751","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-839","description":"CWE-839: Numeric Range Comparison Without Minimum Check","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"mongodb","orgId":"a39b4221-9bd0-4244-95fc-f3e2e07f1deb","dateUpdated":"2024-01-23T15:04:48.719Z"},"datePublic":"2020-11-24T00:00:00.000Z","source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cna@mongodb.com","DATE_PUBLIC":"2020-11-24T17:00:00.000Z","ID":"CVE-2019-20925","STATE":"PUBLIC","TITLE":"Denial of service via malformed network packet"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"MongoDB Server","version":{"version_data":[{"version_affected":"<","version_name":"4.2","version_value":"4.2.1"},{"version_affected":"<","version_name":"4.0","version_value":"4.0.13"},{"version_affected":"<","version_name":"3.6","version_value":"3.6.15"},{"version_affected":"<","version_name":"3.4","version_value":"3.4.24"}]}}]},"vendor_name":"MongoDB Inc."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.1; v4.0 versions prior to 4.0.13; v3.6 versions prior to 3.6.15; v3.4 versions prior to 3.4.24."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-839: Numeric Range Comparison Without Minimum Check"}]}]},"references":{"reference_data":[{"name":"https://jira.mongodb.org/browse/SERVER-43751","refsource":"MISC","url":"https://jira.mongodb.org/browse/SERVER-43751"}]},"source":{"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://jira.mongodb.org/browse/SERVER-43751","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T03:00:17.403Z"}}]}}}