| Name | CVE-2025-0755 |
| Description | The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16 |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| mongo-c-driver (PTS) | bullseye | 1.17.6-1 | vulnerable |
| bookworm | 1.23.1-1 | vulnerable | |
| sid, trixie | 1.30.3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| mongo-c-driver | source | (unstable) | 1.27.5-1 |
[bookworm] - mongo-c-driver <no-dsa> (Minor issue; can be fixed via point-release)
https://jira.mongodb.org/browse/SERVER-94461
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/63c3d6f70180f151ffd201376eb33793357e5418 (1.28.0)
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/d3cdb626be30748b9360451023c75438ec346a38 (1.27.5)