PT-2025-36329 · Mongodb+1 · Mongodb Server+2

Published 2025-09-05 · Updated 2025-10-30 · CVE-2025-10059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 6.0.x MongoDB Server versions prior to 7.0.18 MongoDB Server versions prior to 8.0.6

Description An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable.

Recommendations Update MongoDB Server to version 6.0.x or later. Update MongoDB Server to version 7.0.18 or later. Update MongoDB Server to version 8.0.6 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-13816

BIT-MONGODB-2025-10059

CVE-2025-10059

Affected Products

Mongodb Server

Mongodb

Red Os

References · 17

• https://jira.mongodb.org/browse/SERVER-100901 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-100909 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-10059 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-10059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10059 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2025-10059 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-10059 · Security Note
• https://bdu.fstec.ru/vul/2025-13816 · Security Note
• https://twitter.com/CVEnew/status/1964195420260938216 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-mongodb-org-7-cve-2025-10059/?sphrase_id=1339002 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-6-cve-2025-10059 · Note
• https://t.me/CVEtracker/31822 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1964086312819954066 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-7-cve-2025-10059 · Note