New MongoDB Vulnerability Lets Hackers Crash Any MongoDB Server

In Cybersecurity News - Original News Source is cybersecuritynews.com by Blog Writer

New MongoDB Vulnerability Crash MongoDB server

A high-severity vulnerability, CVE-2026-25611 (CVSS 7.5), has been discovered in MongoDB, allowing unauthenticated attackers to crash exposed servers using minimal bandwidth.

According to Cato CTRL, it affects all MongoDB versions where compression is enabled (v3.4+, on by default since v3.6), including MongoDB Atlas.

 Furthermore, Shodan data indicates that over 207,000 MongoDB instances are currently exposed to the internet and at risk.​

Publicly accessible MongoDB servers based on Shodan(source : catonetworks)

Attack Mechanism and Impact

The vulnerability exists in MongoDB’s wire protocol compression mechanism, known as OP_COMPRESSED.

According to Cato CTRL, when the server receives a compressed message, it allocates memory based on the attacker-controlled uncompressedSize value before verifying the actual decompressed size.

An attacker can send a tiny 47KB zlib-compressed packet while claiming an uncompressed size of 48MB.

SentinelOne notes that the server blindly allocates 48MB per connection, resulting in a massive 1,027:1 memory amplification ratio.

MongoDB DoS attack sequence (Source: catonetworks )

By opening multiple concurrent connections, the attacker quickly exhausts the server’s RAM, triggering an Out-of-Memory (OOM) kernel kill with exit code 137.

The efficiency of this Denial-of-Service attack is severe. Cato CTRL’s testing showed that a 512MB server crashes in roughly two seconds with just 10 connections sending 457KB of data.

A 1GB instance falls to 25 connections in three seconds. Even a robust 64GB enterprise database can be taken offline in under a minute using approximately 1,363 connections and just 64MB of traffic from a standard home internet connection.​

Network defenders should monitor for high volumes of TCP connections to port 27017 from a single source, and for rapid connection establishment that remains idle.

vulnerable code(Source: catonetworks )

OP_COMPRESSED packets under 100KB claiming an uncompressed size over 10MB. System indicators include rapid MongoDB memory spikes and OOM killer events targeting the mongod process in system logs.​

To mitigate this threat, administrators should immediately update to the patched MongoDB versions: 8.2.4, 8.0.18, or 7.0.29.

If upgrading is not immediately possible, Cato CTRL advises disabling compression entirely using –networkMessageCompressors=disabled.

Furthermore, organizations must restrict database network access to trusted networks via firewalls, implement connection limits using maxIncomingConnections, and avoid allowing public network access (0.0.0.0/0) on MongoDB Atlas clusters.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.