MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-7259Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash
- CVE-2025-6714Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections
- CVE-2025-6713MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage
- CVE-2025-6712MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation
- CVE-2025-6711Incomplete Redaction of Sensitive Information in MongoDB Server Logs
- CVE-2025-6710Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB
- CVE-2025-6709Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication
- CVE-2025-6707Race condition in privilege cache invalidation cycle
- CVE-2025-6706Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
- CVE-2025-40906BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities
- CVE-2025-3085MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked
- CVE-2025-3084MongoDB Server may crash due to improper validation of explain command
- CVE-2025-3083Malformed MongoDB wire protocol messages may cause mongos to crash
- CVE-2025-3082User may override a view's collation and gain unauthorized access to underlying data
- CVE-2025-0755MongoDB C Driver bson library may be susceptible to buffer overflow
- CVE-2025-1756MongoDB Shell may be susceptible to local privilege escalation in Windows
- CVE-2025-1755MongoDB Compass may be susceptible to local privilege escalation in Windows
- CVE-2025-1693MongoDB Shell may be susceptible to control character Injection via shell output
- CVE-2025-1692MongoDB Shell may be susceptible to control character injection via pasting
- CVE-2025-1691MongoDB Shell may be susceptible to Control Character Injection via autocomplete
- CVE-2024-10921Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
- CVE-2024-8013CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines
- CVE-2024-8305MongoDB Server secondaries may crash due to forced index constraints
- CVE-2024-8654MongoDB Server may access non-initialized region of memory leading to unexpected behaviour
- CVE-2024-8207MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths
- CVE-2024-6384Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
- CVE-2024-7553Accessing Untrusted Directory May Allow Local Privilege Escalation
- CVE-2024-6383MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow
- CVE-2024-6382Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
- CVE-2024-6381MongoDB C Driver bson_strfreev may be susceptible to integer overflow