CVE-2026-25611

Summary

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

Affected Software

VendorProductVersion RangeStatus
MongoDB IncMongoDB Server8.2 < 8.2.4affected
MongoDB IncMongoDB Server8.0 < 8.0.18affected
MongoDB IncMongoDB Server7.0 < 7.0.29affected

Weaknesses

  • CWE-405: CWE-405 Asymmetric Resource Consumption (Amplification)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References