MongoDB CVE-2026-25613
MEDIUM
Incorrect Type Conversion or Cast (CWE-704)
2026-02-10
cna@mongodb.com
6.5
CVSS 3.1
Share
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Lifecycle Timeline
2
Analysis Generated
Mar 12, 2026 - 22:02 vuln.today
CVE Published
Feb 10, 2026 - 19:16 nvd
MEDIUM 6.5
DescriptionNVD
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.
AnalysisAI
MongoDB server denial of service can be triggered by authenticated users querying collections with malformed compound wildcard indexes. An attacker with valid credentials can crash the MongoDB instance, disrupting availability for all users. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).