{"id":"CVE-2025-0755","aliases":["BIT-mongodb-2025-0755","DEBIAN-CVE-2025-0755","DLA-4160-1","DLA-4175-1","EUVD-2025-6467","GHSA-x43h-8pfv-xx24","UBUNTU-CVE-2025-0755","USN-7613-1"],"status":"published","title":"MongoDB C Driver bson library may be susceptible to buffer overflow","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00788,"percentile":0.56528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2025-03-18T09:01:04Z","modified":"2026-10-28T10:58:54Z","fixes":[{"ecosystem":"Bitnami","package":"mongodb","fixed_in":["7.0.16","8.0.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libbson-xs-perl","fixed_in":["0.8.4-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mongo-c-driver","fixed_in":["1.23.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mongo-c-driver","fixed_in":["1.27.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mongo-c-driver","fixed_in":["1.27.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","fixed_in":["1.26.0-1.1ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mongodb","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.16"},{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libbson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-2+deb12u1"}]}],"versions":["0.8.4-2"]},{"source":"osv","ecosystem":"Debian:12","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1+deb12u1"}]}],"versions":["1.23.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.5-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libbson-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1+deb11u1"}]}],"versions":["0.8.4-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1+deb11u1"}]}],"versions":["1.17.6-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0-1","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.16.1-1build1","1.16.1-1build2","1.16.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0-1","1.19.1-1","1.19.2-1","1.20.0-1","1.20.0-1build1","1.20.1-1","1.21.0-1","1.21.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1.1ubuntu2+esm1"}]}],"versions":["1.24.3-1","1.24.4-1","1.25.1-1","1.25.2-1","1.25.4-1","1.26.0-1","1.26.0-1.1ubuntu1","1.26.0-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1ubuntu0.1~esm1"}]}],"versions":["1.15.0-1","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.16.1-1build1","1.16.1-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1ubuntu0.1~esm1"}]}],"versions":["1.18.0-1","1.19.1-1","1.19.2-1","1.20.0-1","1.20.0-1build1","1.20.1-1","1.21.0-1","1.21.0-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1.1ubuntu2+esm1"}]}],"versions":["1.24.3-1","1.24.4-1","1.25.1-1","1.25.2-1","1.25.4-1","1.26.0-1","1.26.0-1.1ubuntu1","1.26.0-1.1ubuntu2"],"bundled":3}],"products":[{"vendor":"mongodb","product":"libbson"},{"vendor":"mongodb","product":"mongodb"},{"vendor":"mongodb inc","product":"libbson"},{"vendor":"mongodb inc","product":"mongodb server"},{"vendor":"mongodb, inc.","product":"mongodb server"}],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-94461","tags":["Issue Tracking","Vendor Advisory","advisory","web","report"]},{"url":"https://jira.mongodb.org/browse/CDRIVER-5601","tags":["Issue Tracking","Vendor Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0755","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x43h-8pfv-xx24"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0755.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-0755","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-0755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-0755","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7613-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-6381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6383","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-0755","title":"MongoDB C Driver bson library may be susceptible to buffer overflow","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:01:04.793Z","modified":"2025-11-03T19:35:09.738Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-6467","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:01:04Z","modified":"2025-11-03T19:35:09Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-x43h-8pfv-xx24","title":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer...","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:31:49Z","modified":"2025-11-03T21:34:15Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:04:23.841448Z"}],"nvd":[{"id":"CVE-2025-0755","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:15:11.487Z","modified":"2026-06-17T08:27:06.11Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-0755","title":"MongoDB C Driver bson library may be susceptible to buffer overflow","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:01:04.793Z","modified":"2026-10-28T10:58:54.491535115Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"DEBIAN-CVE-2025-0755","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:15:11.487Z","modified":"2026-09-01T20:04:23.881161982Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"UBUNTU-CVE-2025-0755","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-03-18T09:15:00Z","modified":"2026-04-22T15:29:02.427258Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"BIT-mongodb-2025-0755","title":"MongoDB C Driver bson library may be susceptible to buffer overflow","description":"The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16","status":"published","published":"2025-09-23T08:46:21.341Z","modified":"2026-09-10T16:01:43.111371624Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"DLA-4160-1","title":"libbson-xs-perl - security update","status":"published","published":"2025-05-09T00:00:00Z","modified":"2026-03-09T01:18:57.590987Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DLA-4175-1","title":"mongo-c-driver - security update","status":"published","published":"2025-05-20T00:00:00Z","modified":"2026-03-09T02:10:12.543668Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-7613-1","title":"mongo-c-driver vulnerabilities","description":"Karman Liu discovered that mongo-c-driver did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2024-6381)\n\nKarman Liu discovered that mongo-c-driver did not correctly handle certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS. (CVE-2024-6383, CVE-2025-0755)","status":"published","published":"2025-07-02T05:37:46Z","modified":"2026-04-27T18:08:47.358466Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}