Loading vulnerability…
Unauthenticated Memory Exhaustion in MongoDB Server Replica-Set Nodes
MongoDB Server replica-set nodes contain an unrestricted resource-allocation vulnerability when processing client-supplied read options specifying a point in time the node will never reach. Internal wait records created for these requests are neither bounded nor reclaimed after the requests end. An unauthenticated attacker with network access can repeatedly trigger this behavior, causing persistent accumulation of wait records and potentially exhausting server memory. Affected releases are 4.4.0–4.4.31, 5.0.0–5.0.34, 6.0.0–6.0.29, 7.0.0–7.0.47, 8.0.0–8.0.36, 8.3.0–8.3.15, and 9.0.0–9.0.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unbounded accumulation of internal wait records can exhaust the affected node's memory and make the database server unavailable. Allocated records persist after the triggering requests end, allowing resource consumption to accumulate across requests. The established impact is denial of service; confidentiality compromise, data modification, and code execution are not established.
Patch, then assume compromise.
Upgrade MongoDB Server to the fixed release for the installed branch: 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, or 9.0.7, or a later release in the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.