CVE-2026-25613— An unsafe cast in the MongoDB query planner can result in a segmentation fault.
Quick assessment
Affected
MongoDB Inc MongoDB Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB Server是美国MongoDB公司的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server存在安全漏洞，该漏洞源于授权用户对包含无效复合通配符索引的集合执行查询，可能导致服务器被禁用。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-25613
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
An unsafe cast in the MongoDB query planner can result in a segmentation fault.
Source: CVE Program / CVE List V5
Vulnerability Description
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的类型转换
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB Server是美国MongoDB公司的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server存在安全漏洞，该漏洞源于授权用户对包含无效复合通配符索引的集合执行查询，可能导致服务器被禁用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB Inc | MongoDB Server | 7.0 ~ 7.0.29 | - |
|
II. Public POCs for CVE-2026-25613
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25613
请登录查看更多情报信息。
Same Patch Batch · MongoDB Inc · 2026-02-10 · 11 CVEs total
| CVE-2026-25611 | 7.5 HIGH | Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server |
| CVE-2026-1848 | 7.5 HIGH | Connections received from the proxy port may not count towards total accepted connections |
| CVE-2026-25612 | 6.5 MEDIUM | Internal ResourceId collision may affect unrelated collections |
| CVE-2026-25610 | 6.5 MEDIUM | Invalid $geoNear index hint may cause server crash |
| CVE-2026-1850 | 6.5 MEDIUM | An authorized user may disable the MongoDB server by issuing a certain type of complex que |
| CVE-2026-1847 | 6.5 MEDIUM | MongoDB Server may crash when inserting large documents |
| CVE-2026-1849 | 6.5 MEDIUM | Mongod can run out of stack memory when expressions create deeply nested documents |
| CVE-2026-2302 | 6.5 MEDIUM | Unsafe Reflection in Mongoid::Criteria.from_hash |
| CVE-2026-2303 | 6.5 MEDIUM | Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or inform |
| CVE-2026-25609 | 5.4 MEDIUM | profile command may permit unauthorized configuration |
IV. Related Vulnerabilities
Same product: MongoDB Server
-
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads -
CVE-2026-82076
Integer Overflow in Query Planner Leads to Unbounded Memory -
CVE-2026-82075
Uncontrolled Resource Consumption in MongoDB Sharded Cluster -
CVE-2026-82074
Incorrect Authorization in MongoDB Server Aggregation Framew -
CVE-2026-82073
Improper Validation in MongoDB Server Aggregation Framework
Same vendor: MongoDB Inc
-
CVE-2026-4359
Heap-buffer-over-read in _mongoc_http_send via strstr on non -
CVE-2026-4358
Memory safety issues in slot-based execution hash table spil -
CVE-2026-4148
ExpressionContext use-after-free in classic engine $lookup a -
CVE-2026-4147
Stack memory disclosure in filemd5 command -
CVE-2026-2303
Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enabl
Same weakness: CWE-704
-
CVE-2026-20249
Cisco Secure Firewall Adaptive Security Appliance and Secure -
CVE-2026-86348
MS Calendar plugin: unrecovered handler panics from malforme -
CVE-2026-87546
Google Chrome 处理逻辑错误漏洞 -
CVE-2026-69585
Microsoft Windows Search Component Elevation of Privilege Vu -
CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi
V. Comments for CVE-2026-25613
No comments yet