CVE-2026-25611

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-405

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-256126.5The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. CollecCVE-2026-256136.5An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.CVE-2026-256147.5Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.CVE-2026-256157.2Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.CVE-2026-256166.1Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.CVE-2026-25628.8A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi CVE-2026-256206.0An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - CVE-2026-256216.0A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to iCVE-2026-256226.0A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NCVE-2026-256236.0An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista NextCVE-2026-256244.8An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat ManagemenCVE-2026-256277.5NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be
CVE-2026-25611: High severity, CVSS 7.5 | Vulnix