Critical severity9.1NVD Advisory· Published Nov 1, 2017· Updated Jun 17, 2026

CVE-2017-15535

Description

MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

MongoDB/MongoDB2 versions
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=3.4.0,<3.4.10
- (no CPE)range: <3.4.10, <3.5.x-development
osv-coords
pkg:rpm/suse/mongodb&distro=SUSE%20Package%20Hub%2012%20SP2
Range: < 3.4.10-5.1

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/101689nvdThird Party AdvisoryVDB Entry
jira.mongodb.org/browse/SERVER-31273nvdIssue TrackingVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000