CVE-2025-12657: 
MongoDB vulnerability analysis and mitigation

The vulnerability (CVE-2025-12657) affects the KMIP response parser in MongoDB binaries. The parser exhibits excessive tolerance for malformed packets, potentially leading to the parsing of invalid objects. This vulnerability was disclosed on November 3, 2025, affecting MongoDB Server versions 6.0 and 8.0 (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v4.0 Base Score of 5.9 (Medium) with the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N. The CVSS v3.1 Base Score is 5.0 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H. The vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions) (NVD, AttackerKB).

When exploited, this vulnerability can result in read access violations when attempting to access the invalidly parsed objects. The vulnerability has a Low impact on confidentiality, No impact on integrity, and High impact on availability of the affected systems (NVD).

The vulnerability has been addressed in MongoDB Server versions 8.2.0-rc0, 8.0.10, and 7.0.22. Users are advised to upgrade to these patched versions (MongoDB Jira).