CVE-2025-11695CWE-295

CVE-2025-11695

High · published October 13, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

When tlsInsecure=False appears in a connection string, certificate validation is disabled.

This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2025-10-13T21:15Z
Affected products (1)
ProductVersionsFixed in
mongodb/rust_driver< 3.2.53.2.5
References (1)
https://jira.mongodb.org/browse/RUST-2264 · [email protected]
EPSS history
Timeline
  • 13 OCT 16:22Z
    Configuration may unexpectedly disable certificate validation
    cvelistv5