CVE-2025-3083

HIGH EPSS 31.7%

Published Apr 1, 20251y ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Apr 1, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

31.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-248

Affected Products 3

Vendor	Product	Version	Range
mongodb	mongodb	*	≥5.0.0 – <5.0.31
mongodb	mongodb	*	≥6.0.0 – <6.0.20
mongodb	mongodb	*	≥7.0.0 – <7.0.16

References 1

jira.mongodb.org https://jira.mongodb.org/browse/SERVER-103152

Issue TrackingVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.