All versions of bson are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string.
A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.