CVE-2026-25612: 
MongoDB vulnerability analysis and mitigation

CVE-2026-25612 is a lock collision vulnerability in the MongoDB server's internal locking mechanism, classified as an Unrestricted Externally Accessible Lock (CWE-412). The flaw arises because MongoDB's internal resource ID encoding can cause unrelated collections to collide in lock representation, leading to conflicting locks and denial of service between those collections. It was published on February 10, 2026, and affects MongoDB server (vendor-confirmed, specific version ranges not yet publicly detailed). The CVSS v3.1 base score is 6.5 (Medium), while the CVSS v4.0 base score is 7.1 (High) (Red Hat Advisory, MongoDB Jira).

The root cause is an encoding collision in MongoDB's internal resource ID (ResourceId) representation used to determine which lock to acquire (CWE-412: Unrestricted Externally Accessible Lock). When two distinct collections inadvertently map to the same internal resource ID encoding, operations on one collection can acquire a lock that conflicts with operations on an unrelated collection, causing one or both to become unavailable. Exploitation requires only low-level authenticated network access with no user interaction, and the attack complexity is low. The vulnerability is tracked upstream in MongoDB's issue tracker as SERVER-114838 (MongoDB Jira, Infinit Sec).

Successful exploitation results in a denial-of-service condition affecting availability of one or more MongoDB collections, with no impact on confidentiality or integrity. A low-privileged, network-authenticated attacker can cause collections to become mutually unavailable due to conflicting lock acquisition, disrupting application functionality dependent on those collections. The scope is limited to the affected MongoDB instance, but in multi-tenant or high-availability deployments, the disruption could cascade to dependent services (Red Hat Advisory, MongoDB Jira).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.036% (0.000360), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 298784 (Tenable).

MongoDB has acknowledged the issue via SERVER-114838; users should monitor the official MongoDB Jira ticket and apply patches as soon as they are released. In the interim, restrict network access to MongoDB instances to trusted clients only, and enforce the principle of least privilege to limit the number of accounts that can trigger lock-intensive operations. Organizations using Red Hat products that bundle MongoDB should monitor the Red Hat advisory for updated package availability (MongoDB Jira, Red Hat Advisory).