CVE-2025-11695 | THREATINT

Description

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5

PUBLISHED Reserved 2025-10-13 | Published 2025-10-13 | Updated 2025-10-21 | Assigner mongodb

HIGH: 8.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Problem types

CWE-295: Improper Certificate Validation

Product status

Default status

unaffected

Any version before v3.2.5

affected

References

jira.mongodb.org/browse/RUST-2264

cve.org (CVE-2025-11695)

nvd.nist.gov (CVE-2025-11695)

Download JSON