CVE-2026-25611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25611", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "state": "PUBLISHED", "assignerShortName": "mongodb", "dateReserved": "2026-02-03T18:21:58.986Z", "datePublished": "2026-02-10T17:52:47.181Z", "dateUpdated": "2026-02-11T15:21:16.207Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MongoDB Server", "vendor": "MongoDB Inc", "versions": [{"lessThan": "8.2.4", "status": "affected", "version": "8.2", "versionType": "semver"}, {"lessThan": "8.0.18", "status": "affected", "version": "8.0", "versionType": "semver"}, {"lessThan": "7.0.29", "status": "affected", "version": "7.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Vitaly Simonovich"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server."}], "value": "A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-405", "description": "CWE-405 Asymmetric Resource Consumption (Amplification)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-02-10T17:52:47.181Z"}, "references": [{"url": "https://jira.mongodb.org/browse/SERVER-116210"}, {"url": "https://jira.mongodb.org/browse/SERVER-116206"}, {"url": "https://jira.mongodb.org/browse/SERVER-116211"}], "source": {"discovery": "EXTERNAL"}, "title": "Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:20:57.244281Z", "id": "CVE-2026-25611", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:21:16.207Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25611", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:20:57.244281Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:21:04.099Z"}}], "cna": {"title": "Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Vitaly Simonovich"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MongoDB Inc", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "8.2", "lessThan": "8.2.4", "versionType": "semver"}, {"status": "affected", "version": "8.0", "lessThan": "8.0.18", "versionType": "semver"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-116210"}, {"url": "https://jira.mongodb.org/browse/SERVER-116206"}, {"url": "https://jira.mongodb.org/browse/SERVER-116211"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.", "supportingMedia": [{"type": "text/html", "value": "A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-405", "description": "CWE-405 Asymmetric Resource Consumption (Amplification)"}]}], "providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-02-10T17:52:47.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25611", "state": "PUBLISHED", "dateUpdated": "2026-02-11T15:21:16.207Z", "dateReserved": "2026-02-03T18:21:58.986Z", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "datePublished": "2026-02-10T17:52:47.181Z", "assignerShortName": "mongodb"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MongoDB Server", "vendor": "MongoDB Inc", "versions": [{"lessThan": "8.2.4", "status": "affected", "version": "8.2", "versionType": "semver"}, {"lessThan": "8.0.18", "status": "affected", "version": "8.0", "versionType": "semver"}, {"lessThan": "7.0.29", "status": "affected", "version": "7.0", "versionType": "semver"}]}], "source": "cna@mongodb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server."}, {"lang": "es", "value": "Una serie de mensajes no autenticados, espec\u00edficamente dise\u00f1ados, pueden agotar la memoria disponible y colapsar un servidor MongoDB."}], "id": "CVE-2026-25611", "lastModified": "2026-06-17T10:24:57.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cna@mongodb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@mongodb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25611", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:20:57.244281Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:37.450", "references": [{"source": "cna@mongodb.com", "url": "https://jira.mongodb.org/browse/SERVER-116206"}, {"source": "cna@mongodb.com", "url": "https://jira.mongodb.org/browse/SERVER-116210"}, {"source": "cna@mongodb.com", "url": "https://jira.mongodb.org/browse/SERVER-116211"}], "sourceIdentifier": "cna@mongodb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-405"}], "source": "cna@mongodb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.2,8.2.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.0,8.0.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0,7.0.29)"}}], "product": "mongodb", "vendor": "mongodb"}], "analysis": {"en": {"generated_at": "2026-04-18T12:49:10.732049+00:00", "value": {"mitigation_remediation": ["Apply a vendor patch or update that addresses this memory exhaustion issue to MongoDB Server.", "Limit inbound connections to the MongoDB port to trusted hosts or networks and consider rate\u2011limiting traffic before it reaches the database server.", "Monitor memory usage of the MongoDB process and set alerts for abnormal increases or process crashes to detect exploitation attempts early."], "summary": {"action": "Assess", "impact": "Denial of Service via memory exhaustion"}, "threat_synthesis": {"affected_systems": "MongoDB Server from MongoDB Inc. is affected; no specific version numbers are indicated, so any instance lacking the fix is potentially vulnerable.", "description_and_impact": "A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server, resulting in a denial of service. The vulnerability requires no authentication and can be triggered over the network.", "risk_and_exploitability": "The CVSS score is 8.7, indicating high severity. The EPSS score is below 1%, so exploitation likelihood is low. The vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector is remote unauthenticated network traffic, where an attacker sends crafted packets to the MongoDB port to trigger memory exhaustion."}}}}, "created": "2026-02-10T21:45:58.794302+00:00", "updated": "2026-04-18T13:00:08.722762+00:00", "vendors": ["mongodb", "mongodb$PRODUCT$mongodb"]}