CVE-2024-21506

Name of the Vulnerable Software and Affected Versions pymongo versions prior to 4.6.3

Description The issue concerns an Out-of-bounds Read in the bson module. An attacker could use a crafted payload to force the parser to deserialize unmanaged memory. The parser attempts to interpret bytes next to the buffer and throws an exception with a string. If the following bytes are not printable UTF-8, the parser throws an exception with a single byte.

Recommendations For versions prior to 4.6.3, update to version 4.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the bson module until a patch is applied. Avoid using crafted payloads that could force the parser to deserialize unmanaged memory.