PT-2025-28180 · Mongodb+2 · Mongodb Server+3

Published 2025-07-07 · Updated 2025-10-05 · CVE-2025-6714

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions 6.0 prior to 6.0.23 MongoDB Server versions 7.0 prior to 7.0.20 MongoDB Server versions 8.0 prior to 8.0.9

Description: The issue affects MongoDB Server's mongos component, causing it to become unresponsive to new connections due to incorrect handling of incomplete data. This occurs when MongoDB is configured with load balancer support, specifically in sharded clusters using HAProxy on specified ports.

Recommendations: For MongoDB Server version 6.0, update to version 6.0.23 or later. For MongoDB Server version 7.0, update to version 7.0.20 or later. For MongoDB Server version 8.0, update to version 8.0.9 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-834

Related Identifiers

ALT-PU-2025-9742

ALT-PU-2025-9750

ALT-PU-2025-9809

ALT-PU-2025-9926

BDU:2025-09086

BIT-MONGODB-2025-6714

CVE-2025-6714

Affected Products

Alt Linux

Mongodb Server

Mongodb

Red Os

References · 14

• https://jira.mongodb.org/browse/SERVER-106753 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09086 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6714 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6714 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6714 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6714 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2025-6714 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6714 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-mongodb-org-060820251 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-mongodb-org-060820252 · Note
• https://twitter.com/CVEnew/status/1942241231943160031 · Twitter Post
• https://twitter.com/cybercronai/status/1942283182595879005 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6714 · Note