CVE-2025-6714: MongoDB mongos Component Unresponsive to New Connections
A vulnerability in MongoDB's mongos component can cause it to become unresponsive to new connections. This issue impacts MongoDB deployments configured with load balancer support, potentially leading to denial of service. Affected versions include MongoDB Server v6.0 (prior to 6.0.23), v7.0 (prior to 7.0.20), and v8.0 (prior to 8.0.9). It requires a specific configuration involving sharded clusters and HAProxy.
Vulnerability Details
- CVE ID: CVE-2025-6714
- Description: MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data when configured with load balancer support.
- CVSS Score: 7.5 HIGH
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
This means the vulnerability is remotely exploitable (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). It doesn't impact confidentiality or integrity (C:N, I:N), but it severely affects availability (A:H), leading to potential denial of service.
- Exploit Requirements: Requires MongoDB sharded clusters configured with load balancer support for mongos using HAProxy on specified ports.
- Affected Vendor, Product, Version: MongoDB Server v6.0 (prior to 6.0.23), v7.0 (prior to 7.0.20), and v8.0 (prior to 8.0.9)
- CWE: CWE-400 and CWE-834 (Resource Exhaustion). These CWEs relate to the server being unable to properly manage or limit resource consumption, potentially leading to a denial-of-service condition.
Timeline of Events
- 2025-07-07: CVE-2025-6714 Published
- (Future Date): Patches Released by MongoDB (v6.0.23, v7.0.20, v8.0.9)
Exploitability & Real-World Risk
While the vulnerability requires a specific configuration (sharded clusters, HAProxy), it poses a significant risk. An attacker could potentially exploit this vulnerability to cause a denial of service, rendering MongoDB databases unavailable. The fact that no authentication is required to trigger this makes it especially concerning.
Recommendations
- Upgrade: Upgrade to MongoDB Server version 6.0.23, 7.0.20, or 8.0.9, or later.
- Monitor: Monitor your MongoDB instances for unusual resource consumption or connection patterns.
- Review Configuration: Ensure your load balancing configuration is robust and mitigates the risk of incomplete data being passed to the
mongoscomponent.
Technical Insight
The vulnerability stems from improper handling of incomplete data by the mongos component. This likely involves a scenario where the component expects complete information but receives only a partial message, leading to resource exhaustion or a hung state. Further investigation is needed to pinpoint the exact code path responsible.
Credit to Researcher(s)
MongoDB Security Team.
References
Tags
#MongoDB #CVE-2025-6714 #DoS #HAProxy #Networking #Vulnerability
Summary: A denial-of-service vulnerability exists in MongoDB's mongos component, affecting sharded clusters configured with HAProxy. The component becomes unresponsive to new connections due to improper handling of incomplete data. Upgrade to versions 6.0.23, 7.0.20, or 8.0.9 to mitigate the risk.
CVE ID: CVE-2025-6714
Risk Analysis: Successful exploitation could lead to denial of service, impacting application availability and potentially causing data access disruption for users.
Recommendation: Upgrade to MongoDB Server version 6.0.23, 7.0.20, or 8.0.9, or later, to address this vulnerability.
Timeline
- 2025-07-07: CVE-2025-6714 Published