CVE-2025-0755
Last modified
CVE-2025-0755 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | Libbson | < 1.27.5 |
| Mongodb | Mongodb | >= 7.0.0, < 7.0.16 |
| Mongodb | Mongodb | 8.0.0 |
References
- https://jira.mongodb.org/browse/CDRIVER-5601Issue Tracking, Vendor Advisory
- https://jira.mongodb.org/browse/SERVER-94461Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-0755?
How severe is CVE-2025-0755?
How do I fix CVE-2025-0755?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0749The Homey theme for WordPress is vulnerable to authenticatio…8.1
- CVE-2025-0750A vulnerability was found in CRI-O. A path traversal issue i…6.6
- CVE-2025-0751A vulnerability classified as critical has been found in Axi…6.5
- CVE-2025-0752A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. …7.1
- CVE-2025-0753A vulnerability classified as critical was found in Axiomati…6.5
- CVE-2025-0754The vulnerability was found in OpenShift Service Mesh 2.6.3 …4.3
- CVE-2025-0756Overview The product receives input from an upstrea…9.1
- CVE-2025-0757Overview The software does not neutralize or incorre…4.4
- CVE-2025-0758Overview The product specifies permissions for a securit…6.1
- CVE-2025-0759IBM EntireX 11.1 could allow a local user to unintentionally…3.3
- CVE-2025-0760A Credential Disclosure vulnerability exists where an admini…2.7
- CVE-2025-0762Use after free in DevTools in Google Chrome prior to 132.0.6…8.8
Are you affected by CVE-2025-0755?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST