{"id":"CVE-2024-6383","aliases":["DEBIAN-CVE-2024-6383","DLA-4160-1","DLA-4175-1","EUVD-2024-47490","GHSA-w25p-2jj3-j5vr","OESA-2024-1880","UBUNTU-CVE-2024-6383","USN-7613-1"],"status":"published","title":"MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00625,"percentile":0.50484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2024-07-03T21:33:47Z","modified":"2026-11-02T12:03:14Z","fixes":[{"ecosystem":"Debian:12","package":"libbson-xs-perl","fixed_in":["0.8.4-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mongo-c-driver","fixed_in":["1.23.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mongo-c-driver","fixed_in":["1.27.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mongo-c-driver","fixed_in":["1.27.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"mongo-c-driver","fixed_in":["1.27.4-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"mongo-c-driver","fixed_in":["1.27.4-1.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"mongo-c-driver","fixed_in":["1.27.4-1.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mongo-c-driver","fixed_in":["1.27.4-1.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"mongo-c-driver","fixed_in":["1.27.4-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","fixed_in":["1.26.0-1.1ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libbson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-2+deb12u1"}]}],"versions":["0.8.4-2"]},{"source":"osv","ecosystem":"Debian:12","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1+deb12u1"}]}],"versions":["1.23.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libbson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1+deb11u1"}]}],"versions":["0.8.4-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1+deb11u1"}]}],"versions":["1.17.6-1"],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libbson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-1","1.3.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libbson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.1-1","1.9.0-1","1.9.2-1","1.9.2-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0-1","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.16.1-1build1","1.16.1-1build2","1.16.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0-1","1.19.1-1","1.19.2-1","1.20.0-1","1.20.0-1build1","1.20.1-1","1.21.0-1","1.21.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1.1ubuntu2+esm1"}]}],"versions":["1.24.3-1","1.24.4-1","1.25.1-1","1.25.2-1","1.25.4-1","1.26.0-1","1.26.0-1.1ubuntu1","1.26.0-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1ubuntu0.1~esm1"}]}],"versions":["1.15.0-1","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.16.1-1build1","1.16.1-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1ubuntu0.1~esm1"}]}],"versions":["1.18.0-1","1.19.1-1","1.19.2-1","1.20.0-1","1.20.0-1build1","1.20.1-1","1.21.0-1","1.21.0-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1.1ubuntu2+esm1"}]}],"versions":["1.24.3-1","1.24.4-1","1.25.1-1","1.25.2-1","1.25.4-1","1.26.0-1","1.26.0-1.1ubuntu1","1.26.0-1.1ubuntu2"],"bundled":3}],"products":[{"vendor":"mongodb inc","product":"libbson"}],"references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-5628","tags":["x_transferred","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0001/","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6383","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0001"},{"url":"https://github.com/advisories/GHSA-w25p-2jj3-j5vr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6383","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1880","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-6383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6383","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7613-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-6381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-0755","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-6383","title":"MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-03T21:33:47.598Z","modified":"2025-11-03T19:34:31.467Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:34:10.961618Z"}],"euvd":[{"id":"EUVD-2024-47490","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-03T21:33:47Z","modified":"2025-11-03T19:34:31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-w25p-2jj3-j5vr","title":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where...","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-04T00:37:45Z","modified":"2025-11-03T21:31:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2024-6383","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-03T22:15:03.24Z","modified":"2026-06-17T08:17:54.17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"DEBIAN-CVE-2024-6383","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-03T22:15:03.24Z","modified":"2026-11-02T12:03:14.132861393Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"OESA-2024-1880","title":"mongo-c-driver security update","description":"mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents.\n\nSecurity Fix(es):\n\nThe bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1(CVE-2024-6383)","status":"published","published":"2024-07-19T11:07:20Z","modified":"2026-08-18T01:18:30.354680181Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-6383","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-03T22:15:00Z","modified":"2026-04-22T15:27:18.39119Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CVE-2024-6383","description":"The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1","status":"published","published":"2024-07-03T22:15:03Z","modified":"2026-04-10T05:19:20.962618Z","updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"DLA-4160-1","title":"libbson-xs-perl - security update","status":"published","published":"2025-05-09T00:00:00Z","modified":"2026-03-09T01:18:57.590987Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DLA-4175-1","title":"mongo-c-driver - security update","status":"published","published":"2025-05-20T00:00:00Z","modified":"2026-03-09T02:10:12.543668Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-7613-1","title":"mongo-c-driver vulnerabilities","description":"Karman Liu discovered that mongo-c-driver did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2024-6381)\n\nKarman Liu discovered that mongo-c-driver did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS. (CVE-2024-6383, CVE-2025-0755)","status":"published","published":"2025-07-02T05:37:46Z","modified":"2026-04-27T18:08:47.358466Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}