{"id":"CVE-2021-20329","aliases":["EUVD-2021-1314","GHSA-f6mq-5m25-4r72","GO-2021-0112","UBUNTU-CVE-2021-20329","openSUSE-SU-2025:15764-1"],"status":"published","title":"Specific cstrings input may not be properly validated in the Go Driver","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00935,"percentile":0.61078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1287","CWE-20"],"published":"2021-06-10T16:30:11Z","modified":"2026-10-20T10:54:27Z","fixes":[{"ecosystem":"Go","package":"go.mongodb.org/mongo-driver","fixed_in":["1.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.mongodb.org/mongo-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1"}]}]},{"source":"osv","ecosystem":"Go","package":"go.mongodb.org/mongo-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.1"}]}]},{"source":"osv","ecosystem":"Go","package":"go.mongodb.org/mongo-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"etcd-for-k8s1.32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.24-1.1"}]}],"bundled":2}],"products":[{"vendor":"mongodb","product":"go_driver"},{"vendor":"mongodb inc.","product":"mongodb go driver"}],"references":[{"url":"https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20329","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-go-driver/pull/622","tags":["web","fix"]},{"url":"https://github.com/mongodb/mongo-go-driver/commit/2aca31d5986a9e1c65a92264736de9fdc3b9b4ca","tags":["web","fix"]},{"url":"https://jira.mongodb.org/browse/GODRIVER-1923","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0112","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f6mq-5m25-4r72"},{"url":"https://github.com/mongodb/mongo-go-driver","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-20329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20329","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-20329","title":"Specific cstrings input may not be properly validated in the Go Driver","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.","status":"published","published":"2021-06-10T16:30:11.055Z","modified":"2024-09-16T22:55:51.498Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:32:55.564736Z"}],"euvd":[{"id":"EUVD-2021-1314","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.","status":"published","published":"2021-06-10T16:30:11Z","modified":"2024-09-16T22:55:51Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:54:58.800859Z"}],"ghsa":[{"id":"GHSA-f6mq-5m25-4r72","title":"go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.","status":"published","published":"2021-06-15T16:08:16Z","modified":"2024-09-17T15:38:08Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-1287"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2021-20329","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.","status":"published","published":"2021-06-10T17:15:08.047Z","modified":"2026-06-17T03:33:41.083Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1287","CWE-20"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"CVE-2021-20329","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.","status":"published","published":"2021-06-10T17:15:08.047Z","modified":"2026-10-20T10:54:27.755888567Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"GHSA-f6mq-5m25-4r72","title":"go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.","status":"published","published":"2021-06-15T16:08:16Z","modified":"2024-09-17T15:38:07Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-1287","CWE-20"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2021-20329","description":"Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.","status":"withdrawn","published":"2021-06-10T17:15:00Z","modified":"2026-02-19T19:26:48.915959Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"GO-2021-0112","title":"Improper input validation in go.mongodb.org/mongo-driver","description":"Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input.","status":"published","published":"2021-07-28T18:08:05Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"openSUSE-SU-2025:15764-1","title":"etcd-for-k8s1.32-3.5.24-1.1 on GA media","description":"These are all security issues fixed in the etcd-for-k8s1.32-3.5.24-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-25T00:00:00Z","modified":"2026-03-23T04:54:10.196331Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}