Description
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pymongo | 2.5.2-1 | — |
| Debian 13 | pymongo | 2.5.2-1 | — |
| Debian 12 | pymongo | 2.5.2-1 | — |
| Debian 7 | pymongo | 2.2-4+deb7u1 | DSA-2705-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | mongodb +1 | 1.6.4-6.el6 | RHSA-2013:1170 |
| Red Hat MRG 2 | pymongo +1 | 1.9-11.el6 | RHSA-2013:1170 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-pymongo | 4.17.0-1.1 | openSUSE-SU-2026:11478-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pymongo | < 2.5.2 | 2.5.2 | GHSA-x33v-f3gp-gw2c |
Advisories 4
- WID-SEC-2026-2726 Red Hat Enterprise MRG: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 10, 2026
- openSUSE-SU-2026:11478-1 python313-pymongo-4.17.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 10, 2026
- DSA-2705-1 pymongo - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2013:1170 Red Hat Security Advisory: mongodb and pymongo security and enhancement update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- openSUSE-SU-2013:1064 vendor-advisory
- USN-1897-1 vendor-advisory
- 93804 vdb-entry
- https://jira.mongodb.org/browse/PYTHON-532
- https://github.com/mongodb/mongo-python-driver/commit/a060c15ef87e0f0e72974c7c0e57fe811bbd06a2
- [oss-security] 20130531 Re: CVE-2013-2132 MongoDB: User-triggerable NULL pointer dereference due to utter plebbery mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710597
- DSA-2705 vendor-advisory
- 60252 vdb-entry