Cato CTRL Details MongoDB CVE-2026-25611 Memory-Exhaustion DoS
Summary
Cato CTRL researcher Vitaly Simonovich reports that CVE-2026-25611 lets unauthenticated network attackers trigger large memory allocations through MongoDB OP_COMPRESSED messages, potentially crashing exposed servers. Patches and mitigations are available.
Key points
- The report says MongoDB allocates memory based on the attacker-controlled OP_COMPRESSED `uncompressedSize` field before validating the decompressed data.
- The flaw can be triggered before authentication when an attacker can reach a vulnerable MongoDB server.
- Cato CTRL’s tests found that a roughly 47KB message can cause a 48MB allocation; 10 connections reportedly crashed a 512MB test instance.
- The article identifies MongoDB versions with compression enabled, starting with version 3.4, as affected; compression has been enabled by default since version 3.6.
- The article reports patches in versions 8.2.4, 8.0.18, and 7.0.29.
- Recommended mitigations include restricting network access, limiting connections, monitoring memory, and disabling compression when not needed.
Article Details
- Attack Vectors
- Unauthenticated attackers can send crafted MongoDB OP_COMPRESSED messages with a large uncompressedSize value, causing memory allocation before the server validates the decompressed data.
- Concurrent connections carrying these messages can exhaust server memory and cause the MongoDB process to be killed by the OOM killer.
- Defensive Notes
- Upgrade affected MongoDB deployments to patched versions: 8.2.4, 8.0.18, or 7.0.29, as applicable.
- Restrict database network access to trusted networks; avoid allowing access from anywhere.
- Use connection limits and OS-level connection rate limiting, and monitor for unusual memory use and suspicious MongoDB traffic.
- Disable network message compression if it is not needed.
MITRE ATT&CK
CVE
People
Vendors
CatoCato CTRL researcher Vitaly Simonovich disclosed CVE-2026-25611, a high-severity vulnerability in MongoDB’s OP_COMPRESSED wire-protocol handling that allows unauthenticated actors to force large memory allocations andMongoDBCato CTRL researcher Vitaly Simonovich disclosed CVE-2026-25611, a high-severity vulnerability in MongoDB’s OP_COMPRESSED wire-protocol handling that allows unauthenticated actors to force large memory allocations and
Products
Cato IPSIPS Protections: Cato IPS detects and blocks malformed OP_COMPRESSED packets and abnormal connection patterns targeting MongoDB.Cato MDRMDR Monitoring: Cato MDR can triage suspicious MongoDB traffic patterns, including connection floods and unusual packet sizes.Cato SASE PlatformNetwork Segmentation: Use Cato’s network segmentation capabilities in the Cato SASE Platform to isolate database traffic from untrusted sources.MongoDBCato CTRL researcher Vitaly Simonovich disclosed CVE-2026-25611, a high-severity vulnerability in MongoDB’s OP_COMPRESSED wire-protocol handling that allows unauthenticated actors to force large memory allocations andMongoDB Atlasversions with compression enabled (version 3.4+, enabled by default since version 3.6), including MongoDB Atlas.