Description
MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| MongoDB Server | MongoDB Inc. / MongoDB Server | 3.6 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | 4.0 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | 4.2 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | >= 4.4, < 4.4.30 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | >= 5.0, < 5.0.32 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | >= 6.0, < 6.0.27 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | >= 7.0, < 7.0.28 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | >= 8.0, < 8.0.17 | affected |
| MongoDB Server | MongoDB Inc. / MongoDB Server | >= 8.2, < 8.2.3 | affected |