A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.
Weakness
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mongodb | Mongodb | 3.6.0 (including) | 3.6.21 (excluding) |
| Mongodb | Mongodb | 4.0.0 (including) | 4.0.20 (excluding) |
| Mongodb | Ubuntu | bionic | * |
| Mongodb | Ubuntu | focal | * |
| Mongodb | Ubuntu | trusty | * |
| Mongodb | Ubuntu | trusty/esm | * |
| Mongodb | Ubuntu | upstream | * |
| Mongodb | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/15.html
- https://cwe.mitre.org/data/definitions/6.html
- https://cwe.mitre.org/data/definitions/79.html