Cyber Resilience

CVE-2024-10921

Mongodb 5.0.0 – 5.0.30

Published
14 November 2024
Modified
01 October 2025
Patch / advisory
View advisory
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0054 42th percentile
Risk Priority 42 floored blend · peak EPSS

Summary

CVE-2024-10921 is a medium-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Mongodb Mongodb. Its CVSS base score is 6.8 (Medium).

Operationally, ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 ,…

more

MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.

CWE(s)
CWE-158

Related Threats

CVEs Like This One

CVE-2026-5170Same product: Mongodb Mongodb
CVE-2026-8199Same product: Mongodb Mongodb
CVE-2026-9740Same product: Mongodb Mongodb
CVE-2026-9749Same product: Mongodb Mongodb
CVE-2026-6914Same product: Mongodb Mongodb
CVE-2026-1850Same product: Mongodb Mongodb
CVE-2026-9748Same product: Mongodb Mongodb
CVE-2025-6712Same product: Mongodb Mongodb
CVE-2026-9754Same product: Mongodb Mongodb
CVE-2026-9741Same product: Mongodb Mongodb

Affected Assets

mongodb
mongodb
5.0.0 — 5.0.30 · 6.0.0 — 6.0.19 · 7.0.0 — 7.0.15

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.10

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect null-byte flaws but does not itself implement the neutralization.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.

A.8.26 Application security requirements partial match
prevents

Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.

References