CVE-2024-5629
highpriority · track · 32EPSS 0.007 · 52 %ileDEEURUUSEPSS · scored 2026-10-28
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.7–8.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (8)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-1217Red Hat Enterprise Linux pymongo: Schwachstelle ermöglicht Denial of Service und OffenlegungDeutsch2025-06-02csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.
- GHSA-m87m-mmvp-v9qmPyMongo Out-of-bounds Read in the bson module 2024-06-05ghsa · osvUS
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
- PYSEC-2026-1826PyMongo Out-of-bounds Read in the bson module 2026-07-07vendor · osvUS
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-5629cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-5629/cnnvd
- https://jira.mongodb.org/browse/PYTHON-4305cnnvd
- https://vigilance.fr/vulnerability/PyMongo-out-of-bounds-memory-reading-via-Bson-Module-44529cnnvd
- https://jira.mongodb.org/browse/PYTHON-4305enisa_euvd
- https://lists.debian.org/debian-lts-announce/2024/06/msg00007.htmlenisa_euvd
- https://jira.mongodb.org/browse/PYTHON-4305Issue TrackingPatchThird Party Advisorynvd
- https://lists.debian.org/debian-lts-announce/2024/06/msg00007.htmlThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan