CVE-2017-15535 Denial of service in n/a
A malicious attacker can cause denial of service or modify memory in MongoDB when the disabled-by-default wire protocol compression feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15535?
CVE-2017-15535 is a critical denial of service vulnerability in Mongodb Mongodb, published on 1 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
Which versions are affected by CVE-2017-15535?
It affects 1 product.
Linux distribution packages (2)
mongodb SUSE:Package Hub 12 SP2 | All versions | 3.4.10-5.1 |
mongodb SUSE:Package Hub 12 SP2 | All versions | 3.4.10-5.1 |
Products include Mongodb Mongodb.
How do I fix CVE-2017-15535?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-15535 being exploited?
There is no known exploitation of CVE-2017-15535 in the wild and no public exploit code.
Other vulnerabilities in Mongodb Mongodb
- CVE-2025-14847 MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency
- CVE-2026-82067 Auth bypass in MongoDB Server
- CVE-2026-13072 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
- CVE-2026-18691 Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
- CVE-2024-1351 MongoDB Server may allow successful untrusted connection
Sources
Also known as GHSA-pm5g-pw4v-3mv8, openSUSE-SU-2017:3018-1, openSUSE-SU-2017:3022-1.