EUVD-2026-35857
GHSA-wvrr-4w4f-3v54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
AnalysisAI
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. No public exploit identified at time of analysis, but the low-complexity, no-auth profile makes this a priority patch for internet-reachable MongoDB deployments.
Technical ContextAI
MongoDB Server (cpe:2.3:a:mongodb:mongodb_server) is a widely deployed document database that uses BSON (Binary JSON) as its native wire and storage format. The vulnerability sits in the BSON validator, which is responsible for ensuring incoming documents conform to the BSON spec before they are processed. CWE-674 (Uncontrolled Recursion) describes precisely the failure mode here: when the validator encounters certain nested binary subtypes, two validation functions call back into each other in a mutual recursion pattern, and each re-entry resets the internal depth counter. Because the depth guard is the mechanism intended to prevent stack exhaustion on adversarial input, resetting it on every mutual call defeats the guard entirely and lets a single crafted message exhaust the process stack, terminating mongod.
RemediationAI
Patch available per vendor advisory - upgrade mongod to the patched point release of your major version line as documented in MongoDB JIRA SERVER-125063 (https://jira.mongodb.org/browse/SERVER-125063); exact fix versions are not enumerated in the supplied data, so confirm the target build against the ticket before deploying. Until the upgrade is rolled out, restrict mongod's listening port (default 27017) to trusted application subnets via host firewall or security groups so unauthenticated network peers cannot reach the wire protocol, accepting that this does not protect against a malicious or compromised application server sending the crafted message. Enabling authentication (--auth) does not mitigate this issue because the crash is triggered during BSON validation that occurs before authentication completes, so network-layer access control is the only effective interim compensating control.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today