Report feedback

An authenticated remote attacker can carry out a DoS attack on the mongos router by supplying an invalid argument. The vulnerability is exploitable if the sharding functionality is used [4][1].

The vulnerability is present in product:

• MongoDB; >=8.1, <8.1.0-rc0; >=8.0, <8.0.6; >=7.0, <7.0.18; >=6.0, <6.0.24;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-10059 at cve.org, NVD
• CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org

The vulnerability was publicly disclosed 5. 9. 2025.

An authenticated remote attacker can carry out a DoS attack on the MongoDB server by executing a specially crafted upsert command [5][2].

The vulnerability is present in product:

• MongoDB; >=8.1, <8.1.0-rc0; >=7.0, <7.0.22; >=6.0, <6.0.25; >=8.0, <8.0.12;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-10060 at cve.org, NVD
• CWE-672: Operation on a Resource after Expiration or Release at cwe.mitre.org

The vulnerability was publicly disclosed 5. 9. 2025.

An authenticated remote attacker can carry out a DoS attack on the MongoDB server by means of a specially crafted $group query [6][3].

The vulnerability is present in product:

• MongoDB; >=8.2, <8.2.0-rc0; >=8.1, <8.1.2; >=7.0, <7.0.22; >=6.0, <6.0.25, >=8.0, <8.0.12;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-10061 at cve.org, NVD
• CWE-20: Improper Input Validation at cwe.mitre.org

The vulnerability was publicly disclosed 5. 9. 2025.