{"id":"CVE-2019-20925","aliases":["EUVD-2019-11455","GHSA-q4wj-8854-jvxq","UBUNTU-CVE-2019-20925","USN-5101-1"],"status":"published","title":"Denial of service via malformed network packet","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01676,"percentile":0.77037,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-697","CWE-839"],"published":"2020-11-24T11:00:16Z","modified":"2026-10-24T14:03:41Z","fixes":[{"ecosystem":"Ubuntu:18.04:LTS","package":"mongodb","fixed_in":["1:3.6.3-0ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mongodb","fixed_in":["1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.6.3-0ubuntu1.4"}]}],"versions":["1:3.4.7-1","1:3.4.7-1ubuntu1","1:3.4.7-1ubuntu2","1:3.4.7-1ubuntu4","1:3.4.14-3ubuntu1","1:3.4.14-3ubuntu2","1:3.6.3-0ubuntu1","1:3.6.3-0ubuntu1.1","1:3.6.3-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3"}]}],"versions":["1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2","1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5","1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.6.3-0ubuntu1.4"}]}],"versions":["1:3.4.7-1","1:3.4.7-1ubuntu1","1:3.4.7-1ubuntu2","1:3.4.7-1ubuntu4","1:3.4.14-3ubuntu1","1:3.4.14-3ubuntu2","1:3.6.3-0ubuntu1","1:3.6.3-0ubuntu1.1","1:3.6.3-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3"}]}],"versions":["1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2","1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5","1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2"]}],"products":[{"vendor":"mongodb","product":"mongodb"},{"vendor":"mongodb inc.","product":"mongodb server"},{"vendor":"mongodb, inc.","product":"mongodb server"}],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-43751","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20925"},{"url":"https://github.com/advisories/GHSA-q4wj-8854-jvxq"},{"url":"https://ubuntu.com/security/CVE-2019-20925","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5101-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20925","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-20925","title":"Denial of service via malformed network packet","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","status":"published","published":"2020-11-24T11:00:16.027Z","modified":"2024-09-16T23:45:46.251Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-839"],"updated_at":"2026-11-02T14:20:17.11067Z"}],"euvd":[{"id":"EUVD-2019-11455","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","status":"published","published":"2020-11-24T11:00:16Z","modified":"2024-09-16T23:45:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:54:46.734285Z"}],"ghsa":[{"id":"GHSA-q4wj-8854-jvxq","title":"An unauthenticated client can trigger denial of service by issuing specially crafted wire...","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.1; v4.0 versions prior to 4.0.13; v3.6 versions prior to 3.6.15; v3.4 versions prior to 3.4.24.","status":"published","published":"2022-05-24T17:34:51Z","modified":"2024-02-01T05:07:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-697","CWE-839"],"updated_at":"2026-11-02T14:55:31.245778Z"}],"nvd":[{"id":"CVE-2019-20925","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","status":"published","published":"2020-11-24T11:15:10.607Z","modified":"2026-06-17T02:31:27.03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-839","CWE-697"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-20925","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","status":"published","published":"2020-11-24T11:15:10.607Z","modified":"2026-10-24T14:03:41.430132015Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"UBUNTU-CVE-2019-20925","description":"An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.","status":"published","published":"2020-11-24T11:15:00Z","modified":"2026-02-04T02:22:09.820903Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"USN-5101-1","title":"mongodb vulnerability","description":"It was discovered that MongoDB incorrectly handled certain wire protocol\nmessages. A remote attacker could possibly use this issue to cause MongoDB\nto crash, resulting in a denial of service.\n","status":"published","published":"2021-10-04T16:59:51Z","modified":"2026-02-10T04:42:20Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}