CVE-2026-25611
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Feb 10, 2026
CISA due date
—
The record
A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a… CWE-405
- CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by… CWE-405
- CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the header… CWE-405
- CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should… CWE-405
- CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS… CWE-405
- CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. CWE-405
- CVE-2026-54874 Issue summary: Receiving a DTLS record for a future epoch while a handshake is in… CWE-405
- CVE-2026-23930 An unauthenticated user is able to cause disproportionate CPU load on the Frontend… CWE-405