InfoSecBulletin Cybersecurity for mankind
A new vulnerability, CVE-2026-25611 (CVSS 7.5), has been found in MongoDB, enabling attackers to crash open servers with little bandwidth.
According to Cato CTRL, it affects all MongoDB versions where compression is enabled (v3.4+, on by default since v3.6), including MongoDB Atlas. Shodan data shows that over 207,000 MongoDB instances are publicly accessible and at risk.
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Attack Mechanism
The vulnerability exists in MongoDB’s wire protocol compression mechanism, known as OP_COMPRESSED. Cato CTRL states that when a server gets a compressed message, it allocates memory using the uncompressedSize provided by the attacker before checking the real decompressed size.
An attacker can send a small 47KB zlib-compressed packet while pretending it is 48MB uncompressed. SentinelOne reports that the server allocates 48MB for each connection, leading to a high memory amplification ratio of 1,027:1.
By opening multiple concurrent connections, the attacker quickly exhausts the server’s RAM, triggering an Out-of-Memory (OOM) kernel kill with exit code 137. Network defenders should watch for many TCP connections to port 27017 from one source, especially if connections are quickly made but idle.
Administrators must quickly update to patched MongoDB versions: 8.2.4, 8.0.18, or 7.0.29 to address this threat.
