EUVD-2026-47787Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible without authentication (PR:N, AV:N); no user interaction or complexity; limited availability impact only with no scope change, confidentiality, or integrity effect.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.
AnalysisAI
Excessive CPU consumption in MongoDB Server's awaitable hello command exhaust mode allows unauthenticated remote clients to degrade server availability without any credentials. A specific parameter combination triggers a server-side response loop that bypasses normal throttling mechanisms, meaning even a small number of malicious connections can measurably impair database availability. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 with VA:L reflects a real but bounded availability impact.
Technical ContextAI
The vulnerability involves MongoDB's implementation of the awaitable hello command (the successor to isMaster) combined with the exhaust cursor wire protocol mode. In exhaust mode, the MongoDB server streams responses to the client continuously without requiring repeated client requests - a legitimate optimization for monitoring and driver heartbeat use cases. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: when a specific combination of parameters is submitted alongside the awaitable hello command in exhaust mode, the server enters a response loop that fails to apply its normal rate or resource throttling, causing uncontrolled CPU consumption. The flaw is in the server's handling logic for this command variant, not in the exhaust protocol itself. No CPE strings were provided in the source intelligence, so exact affected product versions must be confirmed via MongoDB Jira ticket SERVER-128517.
RemediationAI
No vendor-released patch version has been confirmed from the available data - the primary reference is MongoDB Jira ticket SERVER-128517 (https://jira.mongodb.org/browse/SERVER-128517), which should be monitored for fix releases. Until a patch is available, the most effective compensating control is network-level access restriction: bind MongoDB to trusted IP ranges using the net.bindIp configuration directive or enforce firewall rules to block TCP port 27017 from untrusted sources, which eliminates unauthenticated network access entirely with no functional trade-off for internal deployments. Additionally, deploy connection-count limits at the load balancer or MongoDB maxIncomingConnections setting to reduce the blast radius of any successful exploit attempt, though this may affect legitimate traffic during peaks. Monitor MongoDB server CPU metrics and correlate spikes with hello command traffic using the database profiler or system monitoring tools to enable rapid detection. Avoid exposing MongoDB ports to the public internet regardless of this specific CVE.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today