Medium severity · published Feb 10, 2026
CVE-2026-25612
Internal ResourceId collision may affect unrelated collections
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
MongoDB Server · MongoDB Inc
8.2 before 8.2.4; 8.0 before 8.0.18; 7.0 before 7.0.29 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25612
jira.mongodb.org
https://jira.mongodb.org/browse/SERVER-114838
jira.mongodb.org
https://jira.mongodb.org/browse/SERVER-115296
More from MongoDB Server
7.5
CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
8.8
CVE-2026-8201
Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
8.8
CVE-2026-8053
FlatBSON Duplicate Field Index Drift
8.8
CVE-2026-4148
ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators
7.5
CVE-2026-4358
Memory safety issues in slot-based execution hash table spill