CVE-2025-11979: MongoDB Server Buffer Overflow Vulnerability

CVE-2025-11979 Overview

CVE-2025-11979 is a denial-of-service vulnerability in MongoDB Server. An authenticated user can crash the server by triggering a buffer over-read through concurrent Data Definition Language (DDL) operations and queries. The flaw is classified as [CWE-416] Use After Free and affects multiple release branches of the database.

The issue impacts MongoDB Server v7.0 versions prior to 7.0.25, v8.0 versions prior to 8.0.15, and v8.2.0. Exploitation requires low-privileged authenticated access over the network and no user interaction. Successful exploitation results in high availability impact without affecting confidentiality or integrity.

Critical Impact

An authorized user can remotely crash MongoDB Server instances by issuing DDL operations concurrently with queries, disrupting database availability.

Affected Products

• MongoDB Server v7.0 versions prior to 7.0.25
• MongoDB Server v8.0 versions prior to 8.0.15
• MongoDB Server version 8.2.0

Discovery Timeline

• 2025-10-20 - CVE-2025-11979 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11979

Vulnerability Analysis

The vulnerability resides in MongoDB Server's handling of concurrent operations against database objects. When an authenticated user issues a DDL operation while queries are actively executing against the same target, the server can perform a buffer over-read on freed memory. This condition triggers a process crash and terminates the server.

The issue is tracked by MongoDB as SERVER-105873 and is categorized under [CWE-416] Use After Free. Exploitation requires only standard authenticated access and does not need administrative privileges. The impact is limited to service availability, but repeated exploitation can produce sustained outages across MongoDB deployments.

Root Cause

The root cause is a race condition between DDL operations, such as collection or index modifications, and in-flight read queries. When a DDL command mutates or removes structures still referenced by concurrent query execution, the query engine reads memory that has already been released or invalidated. This buffer over-read against freed memory produces an unrecoverable server fault.

Attack Vector

An attacker requires network access to the MongoDB Server and valid credentials with permission to execute DDL operations against a target database. The attacker issues a DDL command, such as a collection drop or index change, while concurrent queries execute against the same collection. Under specific timing conditions, the server crashes. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to MongoDB Jira Issue SERVER-105873 for vendor technical details.

Detection Methods for CVE-2025-11979

Indicators of Compromise

• Unexpected MongoDB mongod process termination or restart events in system logs.
• Server log entries indicating segmentation faults or fatal assertions following DDL commands.
• Elevated frequency of DDL operations (dropCollection, createIndex, dropIndex) from a single authenticated principal.
• Connection resets and query failures correlated with DDL activity in application logs.

Detection Strategies

• Monitor MongoDB audit logs for authenticated users issuing DDL operations concurrently with high query volume against the same namespace.
• Correlate mongod crash events with the operation history preceding the crash to identify DDL and query interleaving.
• Alert on running MongoDB Server versions that match affected version ranges via configuration management inventory.

Monitoring Recommendations

• Enable MongoDB auditing to capture DDL commands and the identities issuing them.
• Ship mongod.log and system journal entries to a centralized log platform for crash pattern analysis.
• Track process uptime and unexpected restarts of MongoDB instances as an availability signal.

How to Mitigate CVE-2025-11979

Immediate Actions Required

• Upgrade MongoDB Server v7.0 deployments to version 7.0.25 or later.
• Upgrade MongoDB Server v8.0 deployments to version 8.0.15 or later.
• Upgrade MongoDB Server v8.2.0 deployments to the vendor-supplied fixed release.
• Audit database role assignments and remove DDL permissions from accounts that do not require them.

Patch Information

MongoDB has addressed the issue in Server versions 7.0.25 and 8.0.15, and in the corresponding fix for the 8.2 branch. Refer to MongoDB Jira Issue SERVER-105873 for release details and download links to patched builds.

Workarounds

• Restrict DDL privileges to a limited set of trusted administrative accounts using MongoDB role-based access control.
• Schedule DDL operations during maintenance windows when application query load is minimized.
• Restrict network exposure of MongoDB instances to trusted application tiers using firewall rules and TLS-authenticated connections.

# Example: revoke DDL-capable roles from an application user
mongosh --eval "db.getSiblingDB('admin').revokeRolesFromUser('appUser', [{ role: 'dbAdmin', db: 'appDb' }])"