CVE-2025-6709

EUVD-2025-19228

26.06.2025, 14:15

The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.

The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 40.19%

Affected Products (NVD)

Vendor	Product	Version
mongodb	mongodb	6.0.0 ≤ 𝑥 < 6.0.21
mongodb	mongodb	7.0.0 ≤ 𝑥 < 7.0.17
mongodb	mongodb	8.0.0 ≤ 𝑥 < 8.0.5

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

mongodb

bionic	deferred
focal	deferred
jammy	dne
noble	dne
oracular	dne
plucky	dne
questing	dne
resolute	dne
trusty	deferred
xenial	ignored

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://jira.mongodb.org/browse/SERVER-106748