CVE-2017-14227: MongoDB

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.

Affected products

• MongoDB MongoDB: version 1.7.0 only

Published 2017-09-09. Last modified 2026-06-17.