CVE-2016-3104

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-31058.8The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repositoryCVE-2016-31065.3Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.CVE-2016-31075.5The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" dirCVE-2016-31087.1The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attCVE-2016-31099.8The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.CVE-2016-31107.5mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via anCVE-2016-31115.5pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp CVE-2016-31127.5client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, whichCVE-2016-31136.1Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.CVE-2016-31146.5Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access.CVE-2016-31156.4Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended sheCVE-2016-31166.4CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions
CVE-2016-3104: High severity, CVSS 7.5 | Vulnix