CVE-2025-10059: MongoDB Server DOS Vulnerability

CVE-2025-10059 Overview

CVE-2025-10059 is a denial-of-service vulnerability in MongoDB Server affecting sharded cluster routers. An authenticated client can crash the mongos router process by providing an improperly set lsid (logical session ID) field on a sharded query in a context where the argument does not apply. The flaw stems from improper permission and applicability handling of a generic argument [CWE-732], allowing a low-privileged network attacker to disrupt database availability across the shard.

Critical Impact
Authenticated attackers with network access to a MongoDB router can trigger a crash of the mongos process by sending a sharded query with a malformed lsid field, resulting in loss of database availability.

Affected Products

MongoDB Server 6.0 versions prior to the fixed 6.0.x release
MongoDB Server 7.0 versions prior to 7.0.18
MongoDB Server 8.0 versions prior to 8.0.6

Discovery Timeline

2025-09-05 - CVE-2025-10059 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10059

Vulnerability Analysis

CVE-2025-10059 affects the mongos query router component of MongoDB sharded clusters. MongoDB uses generic arguments, including lsid, to associate operations with a logical session for retryable writes and causal consistency. The router does not correctly validate whether the lsid field is applicable to the received sharded query command. When a client supplies an lsid in a context where the field should not be present, the router encounters an unexpected state and terminates.

Because mongos is the entry point for client traffic in a sharded deployment, a crash disrupts query processing for every application relying on that router. Repeated exploitation across routers can produce a sustained outage of the cluster's query tier. The vulnerability does not affect confidentiality or integrity, only availability.

Root Cause

The root cause is an improper permission and applicability check on a generic command argument [CWE-732]. The router accepts the lsid field on sharded query paths where it is not a valid parameter, then fails to gracefully reject the request. Instead of returning an error response, the process terminates. MongoDB tracks the fix in internal issues SERVER-100901 and SERVER-100909.

Attack Vector

Exploitation requires network reachability to the mongos router and authenticated access with the ability to issue sharded queries. The attacker crafts any sharded query and attaches an lsid field in a request context where the field is not applicable, then submits it to the router. On receipt, the router terminates. No user interaction is required, and attack complexity is low.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the vendor tickets SERVER-100901 and SERVER-100909 for additional context.

Detection Methods for CVE-2025-10059

Indicators of Compromise

Unexpected mongos process terminations or restarts without a corresponding administrative action or resource exhaustion signal.
Client-side connection resets and query timeouts concentrated on specific router endpoints.
Server logs showing fatal errors immediately after processing a command that included an lsid argument on a sharded query path.

Detection Strategies

Enable MongoDB audit logging and profile database commands, then alert on mongos fatal exits correlated with recent command payloads containing lsid.
Inspect load balancer or proxy access logs for repeated sharded query requests from the same client immediately preceding router failures.
Monitor cluster health telemetry for abnormal frequencies of primary router elections or mongos process restarts.

Monitoring Recommendations

Alert on mongos process uptime dropping below expected thresholds across a sharded cluster.
Track authenticated session activity that generates malformed command errors targeting sharded collections.
Baseline the rate of session-related commands per client and flag deviations that coincide with router instability.

How to Mitigate CVE-2025-10059

Immediate Actions Required

Upgrade MongoDB Server 7.0 deployments to version 7.0.18 or later.
Upgrade MongoDB Server 8.0 deployments to version 8.0.6 or later.
Upgrade MongoDB Server 6.0 deployments to the vendor-designated 6.0.x fixed release.
Restrict network access to mongos routers so that only trusted application tiers can reach the database port.

Patch Information

MongoDB has released fixed versions that resolve the improper handling of the lsid field on sharded queries. Refer to SERVER-100901 and SERVER-100909 for change details. Administrators should schedule a rolling upgrade of routers and shard members to a patched release, then validate cluster health post-upgrade.

Workarounds

Enforce least-privilege authentication so only necessary application accounts can issue sharded queries against production clusters.
Place mongos routers behind a network policy or firewall rule that limits inbound connections to known client subnets.
Deploy multiple mongos routers behind a load balancer with health checks so a single crash does not remove query capacity.

bash

# Verify installed MongoDB version and confirm patch level
mongod --version
mongos --version

# Example: restrict mongos access with iptables to trusted app subnet
iptables -A INPUT -p tcp --dport 27017 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 27017 -j DROP