CVE-2017-15535
CriticalSummary
MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development have a disabled-by-default configuration setting, networkMessageCompressors, which when enabled can be exploited by a malicious attacker to deny service or modify memory.
Risk Assessment
Enabling this option may lead to serious availability issues and potential data integrity breaches.
Recommendation
It is recommended that administrators do not enable the networkMessageCompressors option, and if it is enabled, to disable it immediately.
Original NVD description (English source)
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.