CVE-2020-7929
CVE-2020-7929 is a medium-severity vulnerability in Mongodb with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-185.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v2: 4.0
- EPSS exploit prediction: 1% (67th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-185
- Affected product: Mongodb
- Published:
- Last modified:
Description
A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.
Frequently asked questions
- What is CVE-2020-7929?
- A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.
- How severe is CVE-2020-7929?
- CVE-2020-7929 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2020-7929 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-7929?
- CVE-2020-7929 affects Mongodb. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2020-7929?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2020-7929 published?
- CVE-2020-7929 was published on 2021-03-01 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*
More vulnerabilities in Mongodb
- CVE-2017-15535 — Critical (CVSS 9.1): MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting,…
- CVE-2026-11933 — High (CVSS 8.8): A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents…
- CVE-2026-8053 — High (CVSS 8.8): An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write…
- CVE-2026-4148 — High (CVSS 8.8): A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who…
- CVE-2024-1351 — High (CVSS 8.8): Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which…
- CVE-2025-0755 — High (CVSS 8.4): The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when…
Other CWE-185 vulnerabilities
- CVE-2024-52289 — Critical (CVSS 9.8): authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx…
- CVE-2019-12798 — Critical (CVSS 9.8): An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size,…
- CVE-2026-25896 — Critical (CVSS 9.3): fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based…
- CVE-2026-4296 — High (CVSS 8.8): An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to…
- CVE-2018-17984 — High (CVSS 7.8): An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files,…
- CVE-2026-33418 — High (CVSS 7.5): DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in…