PT-2024-25460 · Mongodb+1 · Mongodb Server+2

Judah Schvimer · Published 2024-05-14 · Updated 2025-10-01 · CVE-2024-3374

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions MongoDB Server versions 5.0.0 through 5.0.16 MongoDB Server versions 6.0.0 through 6.0.5

Description An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes.

Recommendations For MongoDB Server versions 5.0.0 through 5.0.16, update to a version later than 5.0.16. For MongoDB Server versions 6.0.0 through 6.0.5, update to a version later than 6.0.5.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALT-PU-2024-8238

ALT-PU-2024-8258

BIT-MONGODB-2024-3374

CVE-2024-3374

Affected Products

Alt Linux

Mongodb Server

Mongodb

References · 9

• https://osv.dev/vulnerability/CVE-2024-3374 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-3374 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2024-3374 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3374 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-75601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3374 · Security Note
• https://t.me/cveNotify/136850 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3374 · Note