CVE-2025-6706
Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
8.8
HIGH
CVSS 3.1
EPSS 0.23%
描述
An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.
如何修補 CVE-2025-6706
要修補 CVE-2025-6706,請將受影響套件升級到下列已修補版本。
- —升級至 6.0.21 或更新版本
CVE-2025-6706 正在被利用嗎?
低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 6.0.0, < 6.0.21, >= 7.0.0, < 7.0.17, >= 8.0.0, < 8.0.4
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |