InfoSecBulletin Cybersecurity for mankind
A new vulnerability, CVE-2026-25611 (CVSS 7.5), has been found in MongoDB, enabling attackers to crash open servers with little bandwidth.
According to Cato CTRL, it affects all MongoDB versions where compression is enabled (v3.4+, on by default since v3.6), including MongoDB Atlas. Shodan data shows that over 207,000 MongoDB instances are publicly accessible and at risk.
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Attack Mechanism
The vulnerability exists in MongoDB’s wire protocol compression mechanism, known as OP_COMPRESSED. Cato CTRL states that when a server gets a compressed message, it allocates memory using the uncompressedSize provided by the attacker before checking the real decompressed size.
An attacker can send a small 47KB zlib-compressed packet while pretending it is 48MB uncompressed. SentinelOne reports that the server allocates 48MB for each connection, leading to a high memory amplification ratio of 1,027:1.
By opening multiple concurrent connections, the attacker quickly exhausts the server’s RAM, triggering an Out-of-Memory (OOM) kernel kill with exit code 137. Network defenders should watch for many TCP connections to port 27017 from one source, especially if connections are quickly made but idle.
Administrators must quickly update to patched MongoDB versions: 8.2.4, 8.0.18, or 7.0.29 to address this threat.
