CVE-2025-6714

MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9 Required Configuration: This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-106753	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:mongodb:::::-:::*
	cpe:2.3:a:mongodb:mongodb:::::-:::*
	cpe:2.3:a:mongodb:mongodb:::::-:::*

History

03 Oct 2025, 20:50

Type	Values Removed	Values Added
First Time		Mongodb mongodb Mongodb
References	~~() https://jira.mongodb.org/browse/SERVER-106753 -~~	() https://jira.mongodb.org/browse/SERVER-106753 - Issue Tracking, Vendor Advisory
CPE		cpe:2.3:a:mongodb:mongodb:::::-:::*

08 Jul 2025, 16:18

Type	Values Removed	Values Added
Summary		(es) El componente Mongos de MongoDB Server puede dejar de responder a nuevas conexiones debido a la gestión incorrecta de datos incompletos. Esto afecta a MongoDB cuando se configura con compatibilidad con balanceadores de carga. Este problema afecta a MongoDB Server v6.0 anterior a 6.0.23, MongoDB Server v7.0 anterior a 7.0.20 y MongoDB Server v8.0 anterior a 8.0.9. Configuración requerida: Afecta a los clústeres fragmentados de MongoDB cuando se configura con compatibilidad con balanceadores de carga para Mongos mediante HAProxy en los puertos especificados.

07 Jul 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-07 15:15

Updated : 2025-10-03 20:50

NVD link : CVE-2025-6714

Mitre link : CVE-2025-6714

CVE.ORG link : CVE-2025-6714

JSON object : View

Products Affected

mongodb

mongodb

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-834

Excessive Iteration

{"id": "CVE-2025-6714", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-07-07T15:15:29.263", "references": [{"url": "https://jira.mongodb.org/browse/SERVER-106753", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-834"}]}], "descriptions": [{"lang": "en", "value": "MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9\n\nRequired Configuration:\n\nThis affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports."}, {"lang": "es", "value": "El componente Mongos de MongoDB Server puede dejar de responder a nuevas conexiones debido a la gesti\u00f3n incorrecta de datos incompletos. Esto afecta a MongoDB cuando se configura con compatibilidad con balanceadores de carga. Este problema afecta a MongoDB Server v6.0 anterior a 6.0.23, MongoDB Server v7.0 anterior a 7.0.20 y MongoDB Server v8.0 anterior a 8.0.9. Configuraci\u00f3n requerida: Afecta a los cl\u00fasteres fragmentados de MongoDB cuando se configura con compatibilidad con balanceadores de carga para Mongos mediante HAProxy en los puertos especificados."}], "lastModified": "2025-10-03T20:50:07.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "A0C122F2-ECD8-4D32-83F9-F250270C87F3", "versionEndExcluding": "6.0.23", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "9F48294B-E0B3-4DED-B5DF-7D93B604C2B2", "versionEndExcluding": "7.0.20", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "F15A536B-BA38-43B2-9E14-4A3F369320F6", "versionEndExcluding": "8.0.9", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}