CVE-2025-10059CWE-732

MongoDB Server router will crash when incorrect lsid is set on a sharded query

Medium · published September 5, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-09-05T20:26Z
EPSS history
Timeline
  • 05 SEP 20:26Z
    MongoDB Server router will crash when incorrect lsid is set on a sharded query
    cvelistv5