UpHeron
All vulnerabilities

Servers and applications

CVE-2025-12893

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running…

Severity
Low 2.3
Published
25 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.0.26, 8.0.16, 8.2.2
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • From 7.0.0 before 7.0.26
  • From 8.0.0 before 8.0.16
  • From 8.2.0 before 8.2.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-12893
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-12893