CVE-2025-10061

EUVD-2025-27034

05.09.2025, 21:15

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 23.28%

Affected Products (NVD)

Vendor	Product	Version
mongodb	mongodb	6.0.0 ≤ 𝑥 < 6.0.25
mongodb	mongodb	7.0.0 ≤ 𝑥 < 7.0.22
mongodb	mongodb	8.0.0 ≤ 𝑥 < 8.0.12
mongodb	mongodb	8.1.0 ≤ 𝑥 < 8.1.2

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

mongodb

bionic	deferred
focal	deferred
jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne
trusty	not-affected
xenial	deferred

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://jira.mongodb.org/browse/SERVER-99616