CVE-2025-6706: Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Server 6.0to a version that resolves this vulnerability.Fixed in 6.0.21 - Upgrade
Upgrade
MongoDB Server 7.0to a version that resolves this vulnerability.Fixed in 7.0.17 - Upgrade
Upgrade
MongoDB Server 8.0to a version that resolves this vulnerability.Fixed in 8.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6706?
CVE-2025-6706 is considered a high severity vulnerability due to its potential to cause crashes and unexpected behavior in MongoDB Server.
How do I fix CVE-2025-6706?
To fix CVE-2025-6706, upgrade to MongoDB Server version 6.0.21 or later, 7.0.17 or later, or 8.0.4 or later.
Who is affected by CVE-2025-6706?
Authenticated users of MongoDB Server versions earlier than 6.0.21, 7.0.17, or 8.0.4 are at risk of exploiting CVE-2025-6706.
What is the impact of CVE-2025-6706?
CVE-2025-6706 may lead to a use-after-free condition that can crash the MongoDB Server and lead to data instability.
Is it possible for unauthorized users to exploit CVE-2025-6706?
No, CVE-2025-6706 requires authenticated users to trigger the vulnerability, but it can occur even without shutdown permissions.