Read the docs
TI-2012-05337 Aliases CVE-2012-6619GHSA-7gm2-h58c-936h

The default configuration for MongoDB before 2.3.2 does not validate objects, which…

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · Partial
Fix status
Partial Red Hat: 10 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

Why it matters now

EPSS 0.03894 90th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial Red Hat: 2 advisoriesRed Hat: 10 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*up to 2.3.1VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableMongoDB
  • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions up to 2.3.1 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·MongoDB
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mongodb:mongodb:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.7:*:*:*:*:*:*:*2.0.7VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.0.8:*:*:*:*:*:*:*2.0.8VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableMongoDB
cpe:2.3:a:mongodb:mongodb:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableMongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·MongoDB
  • cpe:2.3:a:mongodb:mongodb:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·MongoDB

Remediation

Red Hat 2 advisories

  • RHSA-2014:0440 Released 2014-04-28 · Red Hat rating Moderate
    Red Hat Enterprise MRG Grid 2.5 security, bug fix, and enhancement update
    • Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 condor-7.8.10-0.1.el6, condor-classads-7.8.10-0.1.el6, condor-kbdd-7.8.10-0.1.el6 +3
    • Red Hat MRG Grid Execute Node for RHEL 6 Server v.2 condor-7.8.10-0.1.el6, condor-classads-7.8.10-0.1.el6, condor-kbdd-7.8.10-0.1.el6 +3
    • Red Hat MRG Grid for RHEL 6 Server v.2 condor-7.8.10-0.1.el6, condor-aviary-7.8.10-0.1.el6, condor-classads-7.8.10-0.1.el6 +10
    • Red Hat MRG Management for RHEL 6 ComputeNode v.2 mrg-release-2.5.0-1.el6
    • Red Hat MRG Management for RHEL 6 Server v.2 cumin-0.1.5797-1.el6, mrg-release-2.5.0-1.el6
    • Red Hat MRG Messaging for RHEL 6 Server v.2 mrg-release-2.5.0-1.el6
    • Red Hat MRG Realtime for RHEL 6 Server v.2 mrg-release-2.5.0-1.el6
  • RHSA-2014:0230 Released 2014-03-04 · Red Hat rating Moderate
    mongodb security update
    • Red Hat Enterprise Linux OpenStack Platform 4.0 libmongodb-2.2.4-4.el6ost, mongodb-2.2.4-4.el6ost, mongodb-server-2.2.4-4.el6ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 3AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix yet
Red Hat Enterprise Linux OpenStack Platform 4.0Fixed RHSA-2014:0230
Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2Fixed RHSA-2014:0440
Red Hat MRG Grid Execute Node for RHEL 6 Server v.2Fixed RHSA-2014:0440
Red Hat MRG Grid for RHEL 6 Server v.2Fixed RHSA-2014:0440
Red Hat MRG Management for RHEL 6 ComputeNode v.2Fixed RHSA-2014:0440
Red Hat MRG Management for RHEL 6 Server v.2Fixed RHSA-2014:0440
Red Hat MRG Messaging for RHEL 6 Server v.2Fixed RHSA-2014:0440
Red Hat MRG Realtime for RHEL 6 Server v.2Fixed RHSA-2014:0440
Red Hat Satellite 6.0Fixed—
Red Hat Satellite Capsule 6.0Fixed—
Not affected: 5 products
  • Red Hat OpenShift Enterprise 2
  • Red Hat Satellite 6.0
  • Red Hat Satellite 6.0 - Optional
  • Red Hat Satellite Capsule 6.0
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6619
  2. 2026-10-03 Alias added: GHSA-7gm2-h58c-936h
  3. 2026-10-11 EPSS moved to the 90th–95th percentile

References

Exploit 2

Advisory 2

Other 4

  • TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
  • TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
  • TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
  • TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
  • TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
  • TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7
See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences