Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-11979

Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc. Server

Default version status: unaffected

  • 8.2.0affected
  • 8.0.0 to < 8.0.14affected
  • 7.0.0 to < 7.0.25affected

References