CVE-2025-3083CWE-248

Malformed MongoDB wire protocol messages may cause mongos to crash

High · published April 1, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31,  MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2025-04-01T11:12Z
EPSS history
Timeline
  • 01 APR 11:12Z
    Malformed MongoDB wire protocol messages may cause mongos to crash
    cvelistv5