CVE-2019-20925

—

CVSS 3.1

7.5 high

EPSS

2%p75

Published

Nov 24, 2020 (Nov 24, 2020)

Modified

Jun 17, 2026

Description

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.

Vendors: mongodb
Products: mongodb
Weakness: CWE-839, CWE-697
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.