CVE-2024-5629
Out-of-bounds read in bson module of PyMongo
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds read in bson module of PyMongo
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
CVE-2024-5629- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2024-2101
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
EUVD-2024-2101- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m87m-mmvp-v9qm
PyMongo Out-of-bounds Read in the bson module
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
- Record
GHSA-m87m-mmvp-v9qm- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
CVE-2024-5629- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVAZL-42682
CVE-2024-5629 affecting package python-pymongo 3.10.1-5
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
AZL-42682- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVAZL-42726
CVE-2024-5629 affecting package python-pymongo 4.2.0-9
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
AZL-42726- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-05
Show 11 moreShow less
OSV
Out-of-bounds read in bson module of PyMongo
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
CVE-2024-5629- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-5629
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
DEBIAN-CVE-2024-5629- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-m87m-mmvp-v9qm
PyMongo Out-of-bounds Read in the bson module
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
- Record
GHSA-m87m-mmvp-v9qm- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVPYSEC-2026-1826
PyMongo Out-of-bounds Read in the bson module
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
- Record
PYSEC-2026-1826- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2025:8419
Red Hat Security Advisory: python36:3.6 security update
- Record
RHSA-2025:8419- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
OSVRLSA-2025:8419
Low: python36:3.6 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
- python-pymongo: Out-of-bounds read in bson module (CVE-2024-5629)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:8419- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-5629
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- Record
UBUNTU-CVE-2024-5629- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2025:8419 No score
Low: python36:3.6 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
- python-pymongo: Out-of-bounds read in bson module (CVE-2024-5629)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:8419- Updated
- 2026-11-02
OSVCLSA-2026-1772496669 No score
TuxCare security update for pymongo (1 CVE)
TuxCare rebuilt pymongo to address 1 CVE. Fixed in 3.13.0.post1+tuxcare.
- Record
CLSA-2026-1772496669- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2024-5629 No score
CVE-2024-5629 in pymongo - Patched by Root
Root has patched CVE-2024-5629 in the pymongo package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2024-5629- Updated
- 2026-11-02
OSVUSN-6904-1 No score
pymongo vulnerability
It was discovered that PyMongo incorrectly handled certain BSON. An attacker could possibly use this issue to read sensitive information or cause a crash.
- Record
USN-6904-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pymongoPyPI |
before 4.6.3 | 4.6.3 |
python-nose-docsAlmaLinux:8 |
before 1.3.7-31.module_el8.9.0+3700+efebe9fd | 1.3.7-31.module_el8.9.0+3700+efebe9fd |
python-pymongo-docAlmaLinux:8 |
before 3.7.0-2.module_el8.10.0+3998+2cf36268 | 3.7.0-2.module_el8.10.0+3998+2cf36268 |
python-sqlalchemy-docAlmaLinux:8 |
before 1.3.2-3.module_el8.10.0+3769+3838165b | 1.3.2-3.module_el8.10.0+3769+3838165b |
python-virtualenv-docAlmaLinux:8 |
before 15.1.0-23.module_el8.10.0+3937+b6a3652f | 15.1.0-23.module_el8.10.0+3937+b6a3652f |
python3-PyMySQLAlmaLinux:8 |
before 0.10.1-2.module_el8.9.0+3700+efebe9fd | 0.10.1-2.module_el8.9.0+3700+efebe9fd |
python3-bsonAlmaLinux:8 |
before 3.7.0-2.module_el8.10.0+3998+2cf36268 | 3.7.0-2.module_el8.10.0+3998+2cf36268 |
python3-distroAlmaLinux:8 |
before 1.4.0-2.module_el8.9.0+3700+efebe9fd | 1.4.0-2.module_el8.9.0+3700+efebe9fd |
python3-docsAlmaLinux:8 |
before 3.6.7-2.module_el8.9.0+3700+efebe9fd | 3.6.7-2.module_el8.9.0+3700+efebe9fd |
python3-docutilsAlmaLinux:8 |
before 0.14-12.module_el8.9.0+3700+efebe9fd | 0.14-12.module_el8.9.0+3700+efebe9fd |
Show 96 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3-noseAlmaLinux:8 |
before 1.3.7-31.module_el8.9.0+3700+efebe9fd | 1.3.7-31.module_el8.9.0+3700+efebe9fd |
python3-pygmentsAlmaLinux:8 |
before 2.2.0-22.module_el8.9.0+3700+efebe9fd | 2.2.0-22.module_el8.9.0+3700+efebe9fd |
python3-pymongoAlmaLinux:8 |
before 3.7.0-2.module_el8.10.0+3998+2cf36268 | 3.7.0-2.module_el8.10.0+3998+2cf36268 |
python3-pymongo-gridfsAlmaLinux:8 |
before 3.7.0-2.module_el8.10.0+3998+2cf36268 | 3.7.0-2.module_el8.10.0+3998+2cf36268 |
python3-scipyAlmaLinux:8 |
before 1.0.0-21.module_el8.9.0+3700+efebe9fd | 1.0.0-21.module_el8.9.0+3700+efebe9fd |
python3-sqlalchemyAlmaLinux:8 |
before 1.3.2-3.module_el8.10.0+3769+3838165b | 1.3.2-3.module_el8.10.0+3769+3838165b |
python3-virtualenvAlmaLinux:8 |
before 15.1.0-23.module_el8.10.0+3937+b6a3652f | 15.1.0-23.module_el8.10.0+3937+b6a3652f |
python3-wheelAlmaLinux:8 |
before 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd |
python3-wheel-wheelAlmaLinux:8 |
before 1:0.31.1-3.module_el8.9.0+3700+efebe9fd | 1:0.31.1-3.module_el8.9.0+3700+efebe9fd |
python36AlmaLinux:8 |
before 3.6.8-39.module_el8.10.0+3769+3838165b | 3.6.8-39.module_el8.10.0+3769+3838165b |
python36-debugAlmaLinux:8 |
before 3.6.8-39.module_el8.10.0+3769+3838165b | 3.6.8-39.module_el8.10.0+3769+3838165b |
python36-develAlmaLinux:8 |
before 3.6.8-39.module_el8.10.0+3769+3838165b | 3.6.8-39.module_el8.10.0+3769+3838165b |
python36-rpm-macrosAlmaLinux:8 |
before 3.6.8-39.module_el8.10.0+3769+3838165b | 3.6.8-39.module_el8.10.0+3769+3838165b |
python-pymongoAzure Linux:2 |
through 3.10.1-5 | None known |
python-pymongoAzure Linux:3 |
through 4.2.0-9 | None known |
pymongoTuxCare:PyPI |
3.13.0 up to 3.13.0.post1+tuxcare | 3.13.0.post1+tuxcare |
pymongoDebian:12 |
before 3.11.0-1+deb12u1, plus listed versions 3.11.0-1 |
3.11.0-1+deb12u1 |
pymongoDebian:13 |
before 4.7.3-1 | 4.7.3-1 |
pymongoDebian:14 |
before 4.7.3-1 | 4.7.3-1 |
pymongoDebian:10 |
before 3.7.1-1.1+deb10u1, plus listed versions 3.7.1-1.1 |
3.7.1-1.1+deb10u1 |
pymongoDebian:11 |
before 3.11.0-1+deb11u1, plus listed versions 3.11.0-1 |
3.11.0-1+deb11u1 |
pymongoPyPI |
before 4.6.3, plus listed versions 0.1.1pre0.1.2pre0.100.10.10.10.2 Show 45 moreShow less0.10.30.110.11.10.11.20.11.30.120.130.140.14.10.14.20.150.15.10.15.20.160.1pre0.2pre0.3.1pre0.3pre0.4pre0.5.1pre0.5.2pre0.5.3pre0.5pre0.60.70.7.10.7.20.80.8.10.90.9.10.9.20.9.30.9.40.9.50.9.60.9.71.01.11.1.11.1.21.101.10.11.111.2 |
4.6.3 |
python-PyMySQLRed Hat:enterprise_linux:8::appstream |
before 0:0.10.1-2.module+el8.10.0+20784+edafcd43 | 0:0.10.1-2.module+el8.10.0+20784+edafcd43 |
python-distroRed Hat:enterprise_linux:8::appstream |
before 0:1.4.0-2.module+el8.10.0+20784+edafcd43 | 0:1.4.0-2.module+el8.10.0+20784+edafcd43 |
python-docsRed Hat:enterprise_linux:8::appstream |
before 0:3.6.7-2.module+el8.10.0+20784+edafcd43 | 0:3.6.7-2.module+el8.10.0+20784+edafcd43 |
python-docutilsRed Hat:enterprise_linux:8::appstream |
before 0:0.14-12.module+el8.10.0+20784+edafcd43 | 0:0.14-12.module+el8.10.0+20784+edafcd43 |
python-noseRed Hat:enterprise_linux:8::appstream |
before 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | 0:1.3.7-31.module+el8.10.0+20784+edafcd43 |
python-nose-docsRed Hat:enterprise_linux:8::appstream |
before 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | 0:1.3.7-31.module+el8.10.0+20784+edafcd43 |
python-pygmentsRed Hat:enterprise_linux:8::appstream |
before 0:2.2.0-22.module+el8.10.0+20784+edafcd43 | 0:2.2.0-22.module+el8.10.0+20784+edafcd43 |
python-pymongoRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python-pymongo-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python-pymongo-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python-pymongo-docRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python-sqlalchemyRed Hat:enterprise_linux:8::appstream |
before 0:1.3.2-3.module+el8.10.0+20981+3704b446 | 0:1.3.2-3.module+el8.10.0+20981+3704b446 |
python-sqlalchemy-docRed Hat:enterprise_linux:8::appstream |
before 0:1.3.2-3.module+el8.10.0+20981+3704b446 | 0:1.3.2-3.module+el8.10.0+20981+3704b446 |
python-virtualenvRed Hat:enterprise_linux:8::appstream |
before 0:15.1.0-23.module+el8.10.0+22619+61b70790 | 0:15.1.0-23.module+el8.10.0+22619+61b70790 |
python-virtualenv-docRed Hat:enterprise_linux:8::appstream |
before 0:15.1.0-23.module+el8.10.0+22619+61b70790 | 0:15.1.0-23.module+el8.10.0+22619+61b70790 |
python-wheelRed Hat:enterprise_linux:8::appstream |
before 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | 1:0.31.1-3.module+el8.10.0+20784+edafcd43 |
python3-PyMySQLRed Hat:enterprise_linux:8::appstream |
before 0:0.10.1-2.module+el8.10.0+20784+edafcd43 | 0:0.10.1-2.module+el8.10.0+20784+edafcd43 |
python3-bsonRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python3-bson-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python3-distroRed Hat:enterprise_linux:8::appstream |
before 0:1.4.0-2.module+el8.10.0+20784+edafcd43 | 0:1.4.0-2.module+el8.10.0+20784+edafcd43 |
python3-docsRed Hat:enterprise_linux:8::appstream |
before 0:3.6.7-2.module+el8.10.0+20784+edafcd43 | 0:3.6.7-2.module+el8.10.0+20784+edafcd43 |
python3-docutilsRed Hat:enterprise_linux:8::appstream |
before 0:0.14-12.module+el8.10.0+20784+edafcd43 | 0:0.14-12.module+el8.10.0+20784+edafcd43 |
python3-noseRed Hat:enterprise_linux:8::appstream |
before 0:1.3.7-31.module+el8.10.0+20784+edafcd43 | 0:1.3.7-31.module+el8.10.0+20784+edafcd43 |
python3-pygmentsRed Hat:enterprise_linux:8::appstream |
before 0:2.2.0-22.module+el8.10.0+20784+edafcd43 | 0:2.2.0-22.module+el8.10.0+20784+edafcd43 |
python3-pymongoRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python3-pymongo-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python3-pymongo-gridfsRed Hat:enterprise_linux:8::appstream |
before 0:3.7.0-2.module+el8.10.0+23071+07f1d18e | 0:3.7.0-2.module+el8.10.0+23071+07f1d18e |
python3-scipyRed Hat:enterprise_linux:8::appstream |
before 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | 0:1.0.0-21.module+el8.10.0+20784+edafcd43 |
python3-scipy-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | 0:1.0.0-21.module+el8.10.0+20784+edafcd43 |
python3-sqlalchemyRed Hat:enterprise_linux:8::appstream |
before 0:1.3.2-3.module+el8.10.0+20981+3704b446 | 0:1.3.2-3.module+el8.10.0+20981+3704b446 |
python3-virtualenvRed Hat:enterprise_linux:8::appstream |
before 0:15.1.0-23.module+el8.10.0+22619+61b70790 | 0:15.1.0-23.module+el8.10.0+22619+61b70790 |
python3-wheelRed Hat:enterprise_linux:8::appstream |
before 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | 1:0.31.1-3.module+el8.10.0+20784+edafcd43 |
python3-wheel-wheelRed Hat:enterprise_linux:8::appstream |
before 1:0.31.1-3.module+el8.10.0+20784+edafcd43 | 1:0.31.1-3.module+el8.10.0+20784+edafcd43 |
python36Red Hat:enterprise_linux:8::appstream |
before 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 |
python36-debugRed Hat:enterprise_linux:8::appstream |
before 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 |
python36-develRed Hat:enterprise_linux:8::appstream |
before 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 |
python36-rpm-macrosRed Hat:enterprise_linux:8::appstream |
before 0:3.6.8-39.module+el8.10.0+20784+edafcd43 | 0:3.6.8-39.module+el8.10.0+20784+edafcd43 |
scipyRed Hat:enterprise_linux:8::appstream |
before 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | 0:1.0.0-21.module+el8.10.0+20784+edafcd43 |
scipy-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:1.0.0-21.module+el8.10.0+20784+edafcd43 | 0:1.0.0-21.module+el8.10.0+20784+edafcd43 |
python36Rocky Linux:8 |
before 0:3.6.8-39.module+el8.10.0+1910+234ad790 | 0:3.6.8-39.module+el8.10.0+1910+234ad790 |
python36Rocky Linux:8 |
before 0:3.6.8-39.module+el8.10.0+1592+61442852 | 0:3.6.8-39.module+el8.10.0+1592+61442852 |
python-distroRocky Linux:8 |
before 0:1.4.0-2.module+el8.10.0+1910+234ad790 | 0:1.4.0-2.module+el8.10.0+1910+234ad790 |
python-distroRocky Linux:8 |
before 0:1.4.0-2.module+el8.10.0+1592+61442852 | 0:1.4.0-2.module+el8.10.0+1592+61442852 |
python-docsRocky Linux:8 |
before 0:3.6.7-2.module+el8.10.0+1592+61442852 | 0:3.6.7-2.module+el8.10.0+1592+61442852 |
python-docsRocky Linux:8 |
before 0:3.6.7-2.module+el8.10.0+1910+234ad790 | 0:3.6.7-2.module+el8.10.0+1910+234ad790 |
python-docutilsRocky Linux:8 |
before 0:0.14-12.module+el8.10.0+1592+61442852 | 0:0.14-12.module+el8.10.0+1592+61442852 |
python-docutilsRocky Linux:8 |
before 0:0.14-12.module+el8.10.0+1910+234ad790 | 0:0.14-12.module+el8.10.0+1910+234ad790 |
python-docutilsRocky Linux:8 |
before 0:0.14-12.module+el8.9.0+1531+a18208f5 | 0:0.14-12.module+el8.9.0+1531+a18208f5 |
python-noseRocky Linux:8 |
before 0:1.3.7-31.module+el8.10.0+1592+61442852 | 0:1.3.7-31.module+el8.10.0+1592+61442852 |
python-noseRocky Linux:8 |
before 0:1.3.7-31.module+el8.10.0+1910+234ad790 | 0:1.3.7-31.module+el8.10.0+1910+234ad790 |
python-noseRocky Linux:8 |
before 0:1.3.7-31.module+el8.9.0+1531+a18208f5 | 0:1.3.7-31.module+el8.9.0+1531+a18208f5 |
python-pygmentsRocky Linux:8 |
before 0:2.2.0-22.module+el8.10.0+1592+61442852 | 0:2.2.0-22.module+el8.10.0+1592+61442852 |
python-pygmentsRocky Linux:8 |
before 0:2.2.0-22.module+el8.10.0+1910+234ad790 | 0:2.2.0-22.module+el8.10.0+1910+234ad790 |
python-pygmentsRocky Linux:8 |
before 0:2.2.0-22.module+el8.9.0+1531+a18208f5 | 0:2.2.0-22.module+el8.9.0+1531+a18208f5 |
python-pymongoRocky Linux:8 |
before 0:3.7.0-2.module+el8.10.0+1986+6cb2ea52 | 0:3.7.0-2.module+el8.10.0+1986+6cb2ea52 |
python-PyMySQLRocky Linux:8 |
before 0:0.10.1-2.module+el8.10.0+1592+61442852 | 0:0.10.1-2.module+el8.10.0+1592+61442852 |
python-PyMySQLRocky Linux:8 |
before 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 | 0:0.10.1-2.module+el8.10.0+1860+afcc1c71 |
python-PyMySQLRocky Linux:8 |
before 0:0.10.1-2.module+el8.10.0+1910+234ad790 | 0:0.10.1-2.module+el8.10.0+1910+234ad790 |
python-PyMySQLRocky Linux:8 |
before 0:0.10.1-2.module+el8.10.0+1582+bc278001 | 0:0.10.1-2.module+el8.10.0+1582+bc278001 |
python-sqlalchemyRocky Linux:8 |
before 0:1.3.2-3.module+el8.10.0+1602+b47e27fa | 0:1.3.2-3.module+el8.10.0+1602+b47e27fa |
python-sqlalchemyRocky Linux:8 |
before 0:1.3.2-3.module+el8.10.0+1910+234ad790 | 0:1.3.2-3.module+el8.10.0+1910+234ad790 |
python-virtualenvRocky Linux:8 |
before 0:15.1.0-23.module+el8.10.0+1910+234ad790 | 0:15.1.0-23.module+el8.10.0+1910+234ad790 |
python-wheelRocky Linux:8 |
before 1:0.31.1-3.module+el8.10.0+1592+61442852 | 1:0.31.1-3.module+el8.10.0+1592+61442852 |
python-wheelRocky Linux:8 |
before 1:0.31.1-3.module+el8.10.0+1910+234ad790 | 1:0.31.1-3.module+el8.10.0+1910+234ad790 |
python-wheelRocky Linux:8 |
before 1:0.31.1-3.module+el8.9.0+1531+a18208f5 | 1:0.31.1-3.module+el8.9.0+1531+a18208f5 |
scipyRocky Linux:8 |
before 0:1.0.0-21.module+el8.10.0+1910+234ad790 | 0:1.0.0-21.module+el8.10.0+1910+234ad790 |
scipyRocky Linux:8 |
before 0:1.0.0-21.module+el8.10.0+1592+61442852 | 0:1.0.0-21.module+el8.10.0+1592+61442852 |
pymongoRoot:PyPI |
before 4.5.0+aikido.2 | 4.5.0+aikido.24.6.0+aikido.24.6.0+aikido.34.5.0+aikido.34.5.0+aikido.44.6.0+aikido.4 |
pymongoUbuntu:14.04:LTS |
All versions, plus listed versions 2.6-12.6.2-12.6.3-12.6.3-1build1 |
None known |
pymongoUbuntu:Pro:16.04:LTS |
before 3.2-1ubuntu0.1~esm1, plus listed versions 3.0.3-13.2-13.2-1build1 |
3.2-1ubuntu0.1~esm1 |
pymongoUbuntu:Pro:18.04:LTS |
before 3.6.1+dfsg1-1ubuntu0.1~esm1, plus listed versions 3.4.0-1build23.6.1+dfsg1-1 |
3.6.1+dfsg1-1ubuntu0.1~esm1 |
pymongoUbuntu:20.04:LTS |
before 3.10.1-0ubuntu2.1, plus listed versions 3.7.1-1.13.7.1-1.1build13.10.1-0ubuntu2 |
3.10.1-0ubuntu2.1 |
pymongoUbuntu:22.04:LTS |
before 3.11.0-1ubuntu0.22.04.1, plus listed versions 3.11.0-1build23.11.0-1build33.11.0-1build4 |
3.11.0-1ubuntu0.22.04.1 |
pymongoUbuntu:24.04:LTS |
before 3.11.0-1ubuntu0.24.04.1, plus listed versions 3.11.0-1build63.11.0-1build73.11.0-1build8 |
3.11.0-1ubuntu0.24.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-5629 is a medium vulnerability (CVSS 4.7) in Mongodb Pymongo, published June 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in pymongo 4.6.3.
References
jira.mongodb.org/browse/PYTHON-4305
lists.debian.org/debian-lts-announce/2024/06/msg00007.html
nvd.nist.gov/vuln/detail/CVE-2024-5629
github.com/mongodb/mongo-python-driver/commit/56b6b6dbc267d365d97c037082369dabf37405d2
gist.github.com/keltecc/62a7c2bf74a997d0a7b48a0ff3853a03
Show 17 moreShow less
security.snyk.io/vuln/SNYK-PYTHON-PYMONGO-6370597
access.redhat.com/errata/RHSA-2025:8419
bugzilla.redhat.com/2290585
errata.almalinux.org/8/ALSA-2025-8419.html
security-tracker.debian.org/tracker/CVE-2024-5629
pypi.org/project/pymongo
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8419.json
cve.org/CVERecord?id=CVE-2024-5629
errata.rockylinux.org/RLSA-2025:8419
ubuntu.com/security/CVE-2024-5629
Left out here: 87 versions. The JSON record has them.