CVE-2021-32036

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Feb 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-320376.5An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent tCVE-2021-320395.5Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary filCVE-2021-32046.5SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.CVE-2021-320407.5It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow dCVE-2021-320507.5Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an applicatioCVE-2021-320517.5Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.CVE-2021-320526.1In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs CVE-2021-320535.3JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via historyCVE-2021-320546.1Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered CVE-2021-320559.1Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap_qresync issue in which imap/util.c has an outCVE-2021-320564.3Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on serveCVE-2021-320615.3S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult elemen