A major security issue was recently discovered in MongoDB, with the identifier CVE-2026-25611 and a CVSS score of 7.5. The vulnerability allows unauthorized attackers to crash exposed servers, even with minimal bandwidth, making the threat particularly serious for enterprise and cloud databases. The issue affects all versions of MongoDB where compression is enabled (v3.4+), including MongoDB Atlas. According to data from Shodan, over 207,000 MongoDB instances are currently exposed online.
See also: Google: Half of 2025's zero-days targeted businesses
Mechanism of the Vulnerability and Attack Operation
The vulnerability resides in MongoDB's wire protocol compression mechanism , known as OP_COMPRESSED . When the server receives a compressed message, it allocates memory based on the attacker-controlled uncompressedSize value before verifying the actual uncompressed size. This creates a huge potential for a DoS attack . An attacker can send a small 47KB packet compressed with zlib, claiming that the uncompressed size is 48MB. The server blindly allocates this memory per connection, leading to a 1.027:1 memory amplification ratio.
The consequence is immediate: by opening multiple simultaneous connections, the attacker quickly exhausts the server's RAM, causing an OOM killer crash with exit code 137. Cato CTRL show that a 512MB server crashes in about two seconds with just 10 connections of 457KB, while even a powerful 64GB server can be taken offline in less than a minute with about 1,363 connections and just 64MB of traffic from a typical home internet connection.
See also: Cisco Secure FMC: Vulnerability allows RCE attacks
Symptoms and Attack Indicators
Database administrators should watch for suspicious patterns such as large amounts of TCP connections on port 27017 from a single source or rapid creation of connections that remain idle. Additionally, OP_COMPRESSED packets smaller than 100KB (with declared uncompressed content over 10MB) are a strong indicator of a potential attack.
See also: IPVanish VPN for macOS: Vulnerability allows privilege escalation
MongoDB: Mitigation Measures and Recommended Actions
Updating MongoDB to 8.2.4, 8.0.18, or 7.0.29 is critical to mitigate the threat. In cases where upgrading is not immediately possible, it is recommended to completely disable compressio with the command –networkMessageCompressors=disabled. In addition, organizations should restrict database network access to trusted networks via firewalls, enforce connection limits using maxIncomingConnections , and avoid publicly exposing MongoDB Atlas clusters (0.0.0.0/0).
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
