This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] MongoDB fixes 3 vulnerabilities
MongoDB fixes 3 vulnerabilities with versions 8.0.10, 8.1.1, 7.0.20 and 6.0.23 [1][2][3].
An authenticated remote attacker can carry out a DoS attack by executing memory-intensive operations [1].
The vulnerability is present in product:
- MongoDB; >=8.0, <8.0.10;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-6712 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 26. 7. 2025.
An authenticated remote attacker can potentially carry out a DoS attack by executing specially crafted SQL queries [2].
The vulnerability is present in product:
- MongoDB, >=8.1.0, <8.1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-7259 at cve.org, NVD
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 26. 7. 2025.
An unauthenticated remote attacker can block new connections by sending specially crafted requests. The vulnerability is exploitable only on instances where a load balancer is enabled [3].
The vulnerability is present in product:
- MongoDB; >=8.0, <8.0.9; >=7.0, <7.0.20; >=6.0, <6.0.23;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-6714 at cve.org, NVD
- CWE-834: Excessive Iteration at cwe.mitre.org
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 26. 7. 2025.
Links
By CESNET, z.s.p.o. Martin Krajči on 8. 7. 2025.