bson is vulnerable to denial of service due to incorrect regex validation

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.047, the 91st percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the GitHub Advisory Database, published 5 Mar 2018. New records show when each source confirmed them.

Sources

• GitHub Advisory Database: GHSA-h6rj-8r3c-9gpj
• OSV: GHSA-h6rj-8r3c-9gpj
• nvd.nist.gov/vuln/detail/CVE-2015-4412
• github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999
• bugzilla.redhat.com/show_bug.cgi?id=1229750
• github.com/advisories/GHSA-h6rj-8r3c-9gpj
• github.com/mongodb/bson-ruby
• github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7
• github.com/rubysec/ruby-advisory-db/blob/master/gems/bson/CVE-2015-4412.yml
• sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
• sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
• www.openwall.com/lists/oss-security/2015/06/06/3
• www.securityfocus.com/bid/75045

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.