What’s Vulnerable › Vulnerabilities

CVE-2023-0437: MongoDB client C Driver may infinitely loop when validating certain BSON input data

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-12 · updated 2026-06-17
• Weakness: CWE-835

Description

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

Affected products

• MongoDB C# Driver: before 1.25.0 — fixed in 1.25.0

How to fix

Upgrade to a fixed version: MongoDB C# Driver 1.25.0. Check the vendor advisory for mitigations.

References

• https://jira.mongodb.org/browse/CDRIVER-4747
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GUVOAFZFSYTNBF6R7H4XJM5DHWBRQ6P/
• https://jira.mongodb.org/browse/CDRIVER-4747
• https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html
• https://lists.debian.org/debian-lts-announce/2025/05/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7GUVOAFZFSYTNBF6R7H4XJM5DHWBRQ6P/

Get alerted when CVE-2023-0437 or the next vulnerability affects your stack