New MongoDB Vulnerability Allows Attackers to Crash Servers, Exposing Critical Data

A high-severity denial-of-service (DoS) vulnerability, identified as CVE-2026-25611, has been discovered in MongoDB by Cato CTRL's senior security researcher, Vitaly Simonovich. This vulnerability allows unauthenticated attackers to crash any exposed MongoDB server.

The issue is rooted in MongoDB’s OP_COMPRESSED wire protocol, a compression feature introduced in version 3.4 and enabled by default since version 3.6. The vulnerability is categorized under CWE-405 (Asymmetric Resource Consumption) and has a CVSS 4.0 score of 8.7 and a CVSS 3.1 score of 7.5, indicating high severity.

This flaw affects all MongoDB deployments with compression enabled, including MongoDB Atlas, across versions 7.0, 8.0, and 8.2 prior to their respective patches.

The attack exploits the way MongoDB handles compressed messages. When a message is received, the server reads the uncompressedSize field from the packet header and allocates a memory buffer of that size before verifying if the actual compressed data matches the declared size.

An attacker can send a crafted packet of approximately 47KB while falsely declaring an uncompressedSize of 48MB, causing the server to allocate a large memory block with minimal actual data. This results in a significant amplification ratio of 1,027:1, potentially overwhelming server resources.

The vulnerable function SharedBuffer::allocate(uncompressedSize) in message_compressor_manager.cpp allocates memory before validation occurs, leading to potential resource exhaustion.

The exploit requires no credentials, targeting MongoDB’s wire protocol parsing before any authentication checks. Every internet-facing MongoDB instance is potentially vulnerable, with scalability depending on the target's RAM capacity.

Security teams should monitor for the following indicators:

High volume of TCP connections to port 27017 from a single source IP. OP_COMPRESSED packets (opCode 2012) with uncompressedSize exceeding 10MB but total packet size under 100KB. Rapid memory spikes in the mongod process. Out-of-memory (OOM) killer events in system logs targeting MongoDB. MongoDB process exiting with code 137 (kernel SIGKILL due to OOM).

MongoDB has released updates in versions 7.0.29, 8.0.18, and 8.2.4 to address this vulnerability by validating the uncompressedSize field before any memory allocation.

Organizations are advised to upgrade immediately and avoid exposing port 27017 to 0.0.0.0/0 . MongoDB Atlas users should restrict access through IP access lists and utilize private connectivity rather than public exposure.

Implementing OS-level memory limits using cgroups on Linux can help mitigate risks until patches are applied.

This vulnerability was responsibly disclosed to MongoDB and addressed in collaboration with their security team.

Based on reporting by GBHackers.