CVE-2021-32036: mongodb inc mongodb server
Vulnerability summary
CVE-2021-32036 is a high (CVSS 7.1) vulnerability in mongodb inc mongodb server. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities.
Timeline
- 04-02-2022PublishedVulnerability first disclosed.
- 19-11-2024Last modifiedVulnerability information updated.
Description
An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
+0.01 pp
From 1.03% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mongodb1 product
- mongodb≥ 2.0.0, < 4.2.18 | ≥ 4.4.0, < 4.4.10 | ≥ 5.0.0, < 5.0.4
Mongodb inc1 product
- mongodb server≥ 5.0, ≤ 5.0.3 | ≥ 4.4, ≤ 4.4.9 | ≥ 4.2, ≤ 4.2.16 | ≥ 4.0, ≤ 4.0.28
Ubuntu1 product
- mongodbAll versions (No fix recorded)
3 vendors · 3 products