CVE-2026-25611
Published: 10 February 2026
Summary
CVE-2026-25611 is a high-severity Amplification (CWE-405) vulnerability in Mongodb (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 48.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2026-25611 is a denial-of-service vulnerability affecting MongoDB servers, where a series of specifically crafted, unauthenticated messages can exhaust available memory resources and cause the server to crash. Published on 2026-02-10, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-405, indicating asymmetric resource consumption.
Attackers with network access can exploit this vulnerability without authentication or user interaction, requiring only low attack complexity. Exploitation involves sending the crafted messages to trigger memory exhaustion, resulting in a complete server crash and denial of service with high availability impact, but no effects on confidentiality or integrity.
MongoDB has documented the issue and related fixes in JIRA tickets SERVER-116206, SERVER-116210, and SERVER-116211, which serve as primary references for advisories and patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7056
Vulnerability details
A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables direct exploitation of MongoDB server vulnerability to trigger memory exhaustion and crash, matching T1499.004 (Application or System Exploitation) for Endpoint Denial of Service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements denial-of-service protections to mitigate memory exhaustion from crafted unauthenticated messages targeting MongoDB servers.
Ensures timely flaw remediation by applying MongoDB patches referenced in JIRA tickets SERVER-116206, SERVER-116210, and SERVER-116211 to eliminate the vulnerability.
Protects resource availability, including memory, through mechanisms like priority-based allocation to counter asymmetric resource consumption attacks.