Description
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
Remediation
References
Related Vulnerabilities
MySQL Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2008-4098)
WordPress Plugin Spiffy XSPF Player SQL Injection (0.1)
WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk Cross-Site Scripting (5.154)
Liferay DXP Observable Timing Discrepancy Vulnerability (CVE-2025-43754)
Chamilo Incorrect Privilege Assignment Vulnerability (CVE-2026-1106)