Cato CTRL™ Threat Research: New MongoDB Vulnerability Allows Instant Remote Server Takedown (CVE-2026-25611)

Cato CTRL disclosed CVE-2026-25611, a high-severity denial-of-service vulnerability in MongoDB's OP_COMPRESSED message handling where an attacker can claim a large uncompressedSize to force 48MB allocations per connection from small compressed packets (~47KB), leading to rapid OOM crashes; it affects MongoDB 3.4+ with compression enabled (default since 3.6), is demonstrably exploitable with minimal bandwidth against internet-exposed instances (~207k reported), and the report includes mitigations (patching, restricting access, disabling compression) and IoCs.