CVE-2024-10921: MongoDB Server Buffer Overflow Vulnerability

CVE-2024-10921 Overview

CVE-2024-10921 affects MongoDB Server across the 5.0, 6.0, 7.0, and 8.0 release branches. An authorized user can issue specially crafted requests that construct malformed Binary JSON (BSON) payloads. Processing these payloads triggers server crashes or returns the contents of buffer over-reads from server memory. The flaw is categorized under [CWE-158] (Improper Neutralization of Null Byte or NUL Character) and stems from insufficient validation of BSON structures during request handling. Exploitation requires only low-privilege authenticated access over the network, making the issue relevant to multi-tenant deployments and applications that expose limited database credentials to untrusted components.

Critical Impact
An authenticated attacker can crash the MongoDB Server (denial of service) or extract adjacent server memory contents through buffer over-reads by submitting malformed BSON requests.

Affected Products

MongoDB Server v5.0 versions prior to 5.0.30
MongoDB Server v6.0 versions prior to 6.0.19
MongoDB Server v7.0 versions prior to 7.0.15
MongoDB Server v8.0 versions prior to and including 8.0.2

Discovery Timeline

2024-11-14 - CVE-2024-10921 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10921

Vulnerability Analysis

MongoDB Server encodes documents and wire-protocol messages using BSON, a length-prefixed binary serialization format. When the server parses incoming requests, it relies on internal length fields and type markers to determine how to read subsequent bytes. CVE-2024-10921 arises when a client submits a request whose BSON structure is malformed, for example with inconsistent length declarations or unexpected NUL characters within string types. The parser follows the malformed offsets and reads past the end of the intended buffer.

Two primary outcomes result from this behavior. The server may dereference memory it does not own and terminate the worker process, producing a denial-of-service condition against the database instance. Alternatively, the over-read contents may be reflected back to the caller inside a response, exposing fragments of adjacent server memory to the authenticated attacker.

Root Cause

The root cause is improper validation of BSON element boundaries during deserialization, tracked internally as SERVER-96419. The parser trusts client-supplied length or terminator metadata without cross-checking against the containing document size, allowing reads to extend beyond the allocated buffer.

Attack Vector

Exploitation requires network access to the MongoDB Server and valid credentials with low privileges. The attacker constructs a request containing malformed BSON, for example a string with a missing null terminator or a subdocument whose declared length exceeds the containing frame. Submitting this request to any command surface that deserializes the payload triggers the vulnerable code path. No user interaction is required beyond issuing the crafted operation.

No public proof-of-concept or exploit is currently available. See the MongoDB Jira Issue SERVER-96419 for vendor-side technical details.

Detection Methods for CVE-2024-10921

Indicators of Compromise

Unexpected mongod process crashes or repeated worker restarts recorded in MongoDB server logs.
Log entries containing BSON parsing errors, BadValue, or assertion failures associated with document decoding.
Anomalous responses to authenticated clients that contain non-printable or unexpected binary content in fields where structured data is expected.

Detection Strategies

Compare deployed MongoDB Server versions against the fixed builds (5.0.30, 6.0.19, 7.0.15, and post-8.0.2 releases) and flag any host running an earlier version.
Enable MongoDB audit logging for authenticated commands and alert on high volumes of failed or malformed operations originating from a single principal or source address.
Correlate mongod crash events with the preceding client operation to identify the account and query that triggered the fault.

Monitoring Recommendations

Ship MongoDB audit and diagnostic logs to a centralized platform and alert on parser assertion patterns tied to [CWE-158].
Track service availability metrics for MongoDB replica set members to detect denial-of-service attempts that manifest as repeated primary step-downs.
Monitor authenticated database accounts for unusual query shapes or command frequencies that deviate from application baselines.

How to Mitigate CVE-2024-10921

Immediate Actions Required

Upgrade MongoDB Server to 5.0.30, 6.0.19, 7.0.15, or a release after 8.0.2 on the corresponding branch.
Inventory all MongoDB deployments, including embedded and development instances, to ensure no vulnerable version remains in production.
Rotate credentials for any low-privilege accounts exposed to untrusted networks or applications until patching is complete.

Patch Information

MongoDB has released fixed builds tracked under MongoDB Jira Issue SERVER-96419. Apply the branch-appropriate patched version listed above to eliminate the malformed BSON handling flaw.

Workarounds

Restrict network access to MongoDB Server so that only trusted application hosts can reach the wire-protocol port, reducing the attack surface for authenticated abuse.
Apply least-privilege role assignments so that application accounts cannot execute commands or access databases beyond their functional scope.
Enable authentication and TLS for all MongoDB connections and disable any legacy or anonymous access paths that would expose the parser to untrusted input.

bash

# Verify the running MongoDB Server version against the patched builds
mongosh --quiet --eval 'db.version()'

# Example: restrict listener to a trusted management interface in mongod.conf
net:
  bindIp: 127.0.0.1,10.0.0.10
  port: 27017
security:
  authorization: enabled