CVE-2023-0437: mongodb inc mongodb c driver Infinite Loop
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2023-0437DEBIAN-CVE-2023-0437
Published 12-01-2024Last modified 03-11-2025
Vulnerability summary
CVE-2023-0437 is a high (CVSS 7.5) Infinite Loop vulnerability in mongodb inc mongodb c driver. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.10%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 12-01-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources4 sources · 5.3–7.5
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.10% on 19-09-2026
19-09-202619-10-2026
EPSS score1.10%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- libbson-xs-perl< 0.8.4-2+deb12u1
- mongo-c-driver< 1.23.1-1+deb12u1 | < 1.25.0-1
Mongodb1 product
- c_driver< 1.25.0
Mongodb inc1 product
- mongodb c driver≥ 1.0.0, < 1.25.0
Ubuntu1 product
- mongodbAll versions (No fix recorded)
4 vendors · 5 products
