CVE-2025-0755
Fixed in a distro release EPSS <1%CVSS 8.4
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
Products: MongoDB Inc libbson, MongoDB Inc. MongoDB Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | libbson-xs-perl | 0.8.4-1+deb11u1 |
| Debian 11 | mongo-c-driver | 1.17.6-1+deb11u1 |
| Debian 12 | libbson-xs-perl | 0.8.4-2+deb12u1 |
| Debian 12 | mongo-c-driver | 1.23.1-1+deb12u1 |
| Debian 13 | mongo-c-driver | 1.27.5-1 |
| Debian 14 | mongo-c-driver | 1.27.5-1 |
| Ubuntu 22.04 LTS | mongo-c-driver | no fix |
| Ubuntu Pro 20.04 LTS | mongo-c-driver | no fix |
| Ubuntu Pro 20.04 LTS | mongo-c-driver | 1.16.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | mongo-c-driver | 1.21.0-1ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | mongo-c-driver | 1.26.0-1.1ubuntu2+esm1 |