CVE-2025-6709: Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication
The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.
The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 6.0.21 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.17 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6709?
CVE-2025-6709 has been classified as a denial of service vulnerability.
How do I fix CVE-2025-6709?
To mitigate CVE-2025-6709, update to a MongoDB Server version greater than 7.0.17, 8.0.5, or 6.0.21.
Which versions of MongoDB Server are affected by CVE-2025-6709?
MongoDB Server versions up to but not including 7.0.17, 8.0.5, and 6.0.21 are affected by CVE-2025-6709.
What type of attack does CVE-2025-6709 facilitate?
CVE-2025-6709 facilitates a denial of service attack through the improper handling of date values in JSON input.
Is CVE-2025-6709 related to OIDC authentication?
Yes, CVE-2025-6709 is specifically related to the use of OIDC authentication when processing malicious JSON payloads.