CVE-2025-6706 json
Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
published 2025-06-26 16 mo ago modified 2026-09-08 2 mo ago also BIT-mongodb-2025-6706 , EUVD-2025-19177
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.
Patch / fix
- bitnami mongodb 6.0.21, 7.0.17, 8.0.4
- MongoDB Inc MongoDB Server 6.0.21, 7.0.17, 8.0.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=6.0.0, <6.0.21 >=7.0.0, <7.0.17 >=8.0.0, <8.0.4 |
6.0.21 7.0.17 8.0.4 |
Affected products
- MongoDB Inc MongoDB Server
Classification
- Weakness
-
- CWE-416 Use After Free
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-106746
issue-tracking, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-6706
web
Sources
- CVE List CVE-2025-6706
- NVD CVE-2025-6706
- OSV BIT-mongodb-2025-6706
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.