EUVD-2026-35857
GHSA-wvrr-4w4f-3v54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
AnalysisAI
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. No public exploit identified at time of analysis, but the low-complexity, no-auth profile makes this a priority patch for internet-reachable MongoDB deployments.
Technical ContextAI
MongoDB Server (cpe:2.3:a:mongodb:mongodb_server) is a widely deployed document database that uses BSON (Binary JSON) as its native wire and storage format. The vulnerability sits in the BSON validator, which is responsible for ensuring incoming documents conform to the BSON spec before they are processed. CWE-674 (Uncontrolled Recursion) describes precisely the failure mode here: when the validator encounters certain nested binary subtypes, two validation functions call back into each other in a mutual recursion pattern, and each re-entry resets the internal depth counter. Because the depth guard is the mechanism intended to prevent stack exhaustion on adversarial input, resetting it on every mutual call defeats the guard entirely and lets a single crafted message exhaust the process stack, terminating mongod.
RemediationAI
Patch available per vendor advisory - upgrade mongod to the patched point release of your major version line as documented in MongoDB JIRA SERVER-125063 (https://jira.mongodb.org/browse/SERVER-125063); exact fix versions are not enumerated in the supplied data, so confirm the target build against the ticket before deploying. Until the upgrade is rolled out, restrict mongod's listening port (default 27017) to trusted application subnets via host firewall or security groups so unauthenticated network peers cannot reach the wire protocol, accepting that this does not protect against a malicious or compromised application server sending the crafted message. Enabling authentication (--auth) does not mitigate this issue because the crash is triggered during BSON validation that occurs before authentication completes, so network-layer access control is the only effective interim compensating control.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today