← Vulnerability feed

Vulnerability record · CVE-2023-0437 · published 12 January 2024

CVE-2023-0437: Mongodb c driver vulnerability

Mongodb · C Driver

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

7.5 CVSS 3.1 High EPSS 1.1% · top 35.6% CWE-835 · CWE-835
7.5CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jira.mongodb.org/browse/CDRIVER-4747 Issue TrackingVendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/7GUVOAFZFSYTNBF6R7H4XJM5D
https://jira.mongodb.org/browse/CDRIVER-4747 Issue TrackingVendor Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/7GUVOAFZFSYTNBF6R7H4XJM5D

Track CVE-2023-0437 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2026-6691Mongodb c driver classic buffer overflow vulnerabilityThe MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before…EPSS 0.18%8.2CVE-2026-84964Mongodb c driver double free vulnerabilityA double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client …EPSS 0.26%7.8CVE-2024-7553Mongodb improper access control vulnerabilityIncorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Win…EPSS 0.26%7.5CVE-2021-32050Mongodb c\+\+ information exposure vulnerabilitySome MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The pu…EPSS 0.65%6.9CVE-2026-93395Mongodb c driver vulnerabilityA missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-…EPSS 0.40%6.9CVE-2025-12119Mongodb c driver vulnerabilityA mongoc_bulk_operation_t may read invalid memory if large options are passed.EPSS 0.20%6.3CVE-2026-93394Mongodb c driver vulnerabilityA flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof ev…EPSS 0.32%6.3CVE-2026-84963Mongodb c driver vulnerabilityAn incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be si…EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2023-0437), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.