PT-2025-41792 · Mongodb · Mongodb Rust Driver

Published 2025-10-13 · Updated 2025-12-05 · CVE-2025-11695

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Rust Driver versions prior to 3.2.5

Description The MongoDB Rust Driver is affected by an issue where setting tlsInsecure=False in a connection string disables certificate validation. Normally, this parameter should enforce strict TLS certificate validation, verifying the server's certificate against trusted Certificate Authorities (CAs). Disabling certificate validation can lead to security risks. The vulnerable parameter is tlsInsecure.

Recommendations Ensure the MongoDB Rust Driver is updated to version 3.2.5 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-11695

GHSA-3P6W-GV5G-XJW9

Affected Products

Mongodb Rust Driver

References · 16

• https://jira.mongodb.org/browse/RUST-2264 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3p6w-gv5g-xjw9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11695 · Security Note
• https://github.com/mongodb/mongo-rust-driver · Note
• https://github.com/mongodb/mongo-rust-driver/commit/21ed6aeeea386628621b36a6af2a1a248cc87dcf · Note
• https://github.com/mongodb/mongo-rust-driver/commit/b918cd6676331c45f26dd1acd13e230aaf17fe6d · Note
• https://github.com/mongodb/mongo-rust-driver/pull/1453 · Note
• https://twitter.com/dailycve/status/1996856955173048324 · Twitter Post
• https://twitter.com/CVEnew/status/1977777810027557276 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Reddit Post
• https://t.me/cveNotify/144800 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o7bmsg/resumen_diario_de_vulnerabilidades_15102025 · Reddit Post
• https://t.me/CVEtracker/34781 · Telegram Post
• https://twitter.com/CveTodo/status/1977788494685573601 · Twitter Post