TI-2014-03238 Aliases CVE-2014-3971 GHSA-gr2p-946w-597h

The CmdAuthenticate::_authenticateX509 function in…

LOW 26CWE-20Published 2014-12-25 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

Why it matters now

EPSS 0.01455 73rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:mongodb:mongodb:2.6.0:::::::*	2.6.0	Vulnerable	MongoDB
cpe:2.3:a:mongodb:mongodb:2.6.1:::::::*	2.6.1	Vulnerable	MongoDB

cpe:2.3:a:mongodb:mongodb:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·MongoDB
cpe:2.3:a:mongodb:mongodb:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2014-3971
2026-10-03 Alias added: GHSA-gr2p-946w-597h

References

Advisory 1

https://jira.mongodb.org/browse/SERVER-13753

Other 1

https://github.com/mongodb/mongo/commit/c151e0660b9736fe66b224f1129a16871165251b

TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7

See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences