HIGH🇵🇱 Wersja polska

CVE-2025-3085

CVSS 8.1v3.1pub. 2025-04-01upd. 2025-09-24

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Mongodb

    APP
    Mongodb
    5.0.0 – 5.0.31 (excl.)6.0.0 – 6.0.20 (excl.)7.0.0 – 7.0.16 (excl.)8.0.0 – 8.0.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-13072CRITICAL9.2PL ✓same product

Heap Buffer Overflow w MongoDB (tryb compute) podczas przetwarzania BSON

CVE-2017-15535CRITICAL9.1PL ✓same product

MongoDB: podatność w kompresji protokołu sieciowego — DoS i modyfikacja pamięci

CVE-2025-14847HIGH8.7⚠ KEVsame product

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by ...

CVE-2026-13055HIGH7.1PL ✓same product

MongoDB: DoS poprzez wyrażenie agregacji $_internalIndexKey z compound wildcard index

CVE-2026-13056HIGH7.1PL ✓same product

MongoDB – wyczerpanie pamięci przez wyrażenia generujące duże tablice (DoS)