Executive brief
A vulnerability in MongoDB Server allows an unauthenticated remote attacker to cause excessive CPU usage, potentially slowing down or crashing the database service. By sending specifically crafted commands, an attacker can force the server into a continuous processing loop that bypasses normal safety limits. This can lead to a denial-of-service condition, impacting the availability of applications that rely on the database.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in MongoDB Server's handling of the 'hello' command when used in exhaust mode. An unauthenticated remote attacker can provide a very small or zero 'maxAwaitTimeMS' value, causing the server to bypass normal throttling and enter a high-rate response loop. This 'hot-loop' behavior consumes significant CPU resources and can be triggered by a small number of connections. The issue is addressed by introducing a server-side configuration (minWaitForStreamingHelloMillis) to enforce a minimum timeout floor. Patches are available in versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-06-08: other: Issue reported internally at MongoDB
- 2026-07-22: advisory: CVE published and NVD record created