CVE-2025-10059: MongoDB Server router will crash when incorrect lsid is set on a sharded query

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-05 · updated 2026-06-17
Weakness: CWE-732

Description

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

Affected products

MongoDB: from 6.0.0 before 6.0.24; from 7.0.0 before 7.0.18; from 8.0.0 before 8.0.6 — fixed in 6.0.24, 7.0.18, 8.0.6

How to fix

Upgrade to a fixed version: MongoDB 6.0.24, 7.0.18, 8.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-10059 or the next vulnerability affects your stack