CVE-2021-32040
mediumpriority · track · 31EPSS 0.020 · 81 %ileCHEUUSEPSS · scored 2026-10-27
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16. Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allabb_psirt
ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allcisa_csaf_ot
ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (11)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- 9AKK108472A9037ABB AbilityTM zenon Security Risk Due to End-of-Life MongoDB Component2026-07-30csaf · abb_psirtCH
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.
- ICSA-26-218-01ABB Ability Zenon2026-07-30icsa · cisa_csaf_otUS
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.
- BIT-mongodb-2021-32040Large aggregation pipelines with a specific stage can crash mongod under default configuration2024-03-06vendor · osvUS
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16. Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2021-32040cnnvd
- https://cxsecurity.com/cveshow/CVE-2021-32040/cnnvd
- https://jira.mongodb.org/browse/SERVER-58203cnnvd
- https://jira.mongodb.org/browse/SERVER-59299cnnvd
- https://jira.mongodb.org/browse/SERVER-60218cnnvd
- https://security.netapp.com/advisory/ntap-20220609-0005/cnnvd
- https://vigilance.fr/vulnerability/MongoDB-Server-denial-of-service-via-Stage-Long-Aggregation-Pipeline-38046cnnvd
- https://jira.mongodb.org/browse/SERVER-58203enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan