3 results · Clear filters · Feed
-
Medium 5.9
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who c…
-
Medium 5.1
BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the libra…
-
Medium 6.2
Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can c…