CVE-2025-6714

Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections

State: Published
Severity: 7.5 High
Published: Jul 7, 2025
Updated: Jul 7, 2025
Reserved: Jun 26, 2025

Description

MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9

Required Configuration:

This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	mongodb

Weaknesses

CWE-834 Excessive Iteration
CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
MongoDB ServerMongoDB Inc	6.0 to before 6.0.23Affected 7.0 to before 7.0.20Affected 8.0 to before 8.0.9Affected

References

https://jira.mongodb.org/browse/SERVER-106753

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.