Denial of Service and Data Integrity vulnerability in features command
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.
Summary
An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MongoDB | MongoDB Server | 5.0 – 5.0.3; 4.4 – 4.4.9; 4.2 – 4.2.16; 4.0 – 4.0.28 | — | No fix listed | CNA |
- MongoDB Server VendorMongoDB Affected 5.0 – 5.0.3; 4.4 – 4.4.9; 4.2 – 4.2.16; 4.0 – 4.0.28 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* | 2.0.0 to before 4.2.18; 4.4.0 to before 4.4.10; 5.0.0 to before 5.0.4 | Vulnerable | MongoDB |
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 2.0.0 to before 4.2.18; 4.4.0 to before 4.4.10; 5.0.0 to before 5.0.4 Vulnerable ·MongoDB
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat OpenStack Platform 10 (Newton)
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat Update Infrastructure 3 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32036
- 2026-10-03 Alias added: GHSA-4wcp-phx2-2w2x
References
More Mongodb vulnerabilities
- TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
- TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
- TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
- TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
- TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
- TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7
Sources
- CVE-2021-32036 · CVE Program
- CVE-2021-32036 · NVD
- FIRST EPSS
- GHSA-4wcp-phx2-2w2x · GitHub Advisory Database · CC BY 4.0
- CVE-2021-32036 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences