CVE-2025-6710: Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.
The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 6.0.21 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.17 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6710?
CVE-2025-6710 is considered a critical vulnerability due to the potential for stack overflow in MongoDB Server.
How do I fix CVE-2025-6710?
To mitigate CVE-2025-6710, upgrade to MongoDB Server version 7.0.17 or later, or version 8.0.5 or later.
What versions of MongoDB Server are affected by CVE-2025-6710?
CVE-2025-6710 affects MongoDB Server versions prior to 7.0.17, 8.0.5, and 6.0.21.
What causes CVE-2025-6710?
CVE-2025-6710 is caused by the JSON parsing mechanism that can lead to excessive stack space consumption from crafted JSON inputs.
What are the potential impacts of CVE-2025-6710?
The potential impacts of CVE-2025-6710 include server crashes and denial of service due to stack overflow.