CVE Explorer
CVE-2025-6710
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.
The same issue affects MongoDB Server v6.0 versions prior to 6
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"cpes":["cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:*:*:*:*","cpe:2.3:a:mo…
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:2d6a263c5aff598dcc701cddd13dce9e606275cfb4fc43877842af3d9faa21f8 · sha256:5daff055a883bd94… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:2d6a263c5aff598dcc701cddd13dce9e606275cfb4fc43877842af3d9faa21f8 · sha256:5daff055a883bd94… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-674","description":"CWE-674: Uncontrolled Recursion","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:2d6a263c5aff598dcc701cddd13dce9e606275cfb4fc43877842af3d9faa21f8 · sha256:5daff055a883bd94… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"url":"https://jira.mongodb.org/browse/SERVER-106749"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:2d6a263c5aff598dcc701cddd13dce9e606275cfb4fc43877842af3d9faa21f8 · sha256:5daff055a883bd94… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.