CVE-2026-25612

7.1 highEPSS 0.2%

High (7.1). EPSS 0.2% chance of exploitation in the next 30 days.

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-412
Published: 2026-02-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://jira.mongodb.org/browse/SERVER-114838
https://jira.mongodb.org/browse/SERVER-115296

Check your stack JSON