Executive brief
MongoDB's sharded-cluster router (mongos) contains a vulnerability that allows unauthenticated clients to cause excessive CPU usage through specially crafted connection-monitoring parameters. An attacker with network access can degrade or deny service to legitimate database clients without needing credentials or special privileges.
Technical details
This is an uncontrolled resource consumption vulnerability (denial of service) in the mongos router's request-handling path. The vulnerable component does not apply rate limiting or enforce a minimum timeout on pre-authentication streaming "hello" commands, allowing an unauthenticated client to manipulate connection-monitoring parameters to force CPU-intensive operations. No authentication is required; an attacker only needs network access to a mongos port. The attack impacts availability only; data confidentiality and integrity are not affected. Patches are available in MongoDB versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later.
Affected products
- MongoDB MongoDB before 7.0.41, 8.0.x before 8.0.30, 8.1.x before 8.2.13, 8.2.x before 8.2.13, 8.3.x before 8.3.9, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later