Skip to content
OpenAdvisories
Medium WID-SEC-2025-1983 3 CVEs

MongoDB Server: Mehrere Schwachstellen ermöglichen Denial of Service

Published Sep 7, 2025 · Updated Sep 7, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MongoDB Server ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 3

  • Medium 6.5
    CVE-2025-10059

    MongoDB Server router will crash when incorrect lsid is set on a sharded query

    An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoD…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2025-10060

    MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

    MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. Thi…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2025-10061

    Malformed $group Query May Cause MongoDB Server to Crash

    An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation.…

    MongoDB MongoDB Server mongodb Ubuntu

Revision history

  1. #1

    Initiale Fassung

References