Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2021-32040 is a vulnerability classified as Stack-based Buffer Overflow, affecting MongoDB Server (affected versions: 5.0 – < 5.0.4, 4.4 – ≤ 4.4.28, and other affected versions). This vulnerability is rated Medium, with a CVSS score of 6.5. Current sources do not report this vulnerability as exploited.
A short verification protects the vulnerability source and prevents automated AI abuse.
Verifying...
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16.
Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
