CVE-2024-6382 — Vulnerability in mongodb — CVE Details

MEDIUM

MongoDB Rust driver may issue unintended commands

Published July 2, 2024Updated October 2, 2025Source: osv

Summary

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

Advisory Timeline

First published July 2, 2024 (832 days ago).
Last revised October 2, 2025 — 457 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update mongodb to 2.8.2 or later

cargo update -p mongodb --precise 2.8.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
mongodb	crates.io	All versions	2.8.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-228
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.4 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

References

Frequently Asked Questions

What is CVE-2024-6382?: MongoDB Rust driver may issue unintended commands This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.4/10).
How do I check if my project is affected by CVE-2024-6382?: CVE-2024-6382 affects mongodb. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-6382 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.4

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-32jf-h775-g29h

Related CVEs

CVE-2025-11695
HIGH
MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string
CVE-2026-102821
MEDIUM
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
CVE-2026-102820
MEDIUM
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies