Description

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T22:16:54.650Z",
  "pubdate": "2026-08-28T22:16:54.650Z",
  "executiveSummary": "A resource exhaustion vulnerability exists in the MongoDB Connector for BI, allowing unauthenticated network-reachable clients to cause a Denial of Service (DoS).\nThe vulnerability stems from an unbounded SASL-based authentication negotiation process where a client can initiate an authentication handshake but deliberately stall, preventing the session from closing.\nBy repeatedly triggering this incomplete handshake, an attacker can consume all available connection slots and worker threads, effectively locking out legitimate users from the database connector.\nThis issue represents a high risk to system availability, as the vulnerability does not require authentication or high-level privileges to exploit.\nThe primary impact is the depletion of the configured connection capacity, necessitating a process restart to restore service functionality once exhausted.\nExploitation is trivial for any attacker with network access to the target service, as it requires no complex payloads or specialized permissions.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a time-bound enforcement mechanism within the SASL-based authentication negotiation loop of the MongoDB Connector for BI.\nDuring the standard SASL authentication process, the server-side component allocates a worker thread, reserves a client connection slot, and maintains backend database connections as soon as the initial handshake is received.\nThe implementation fails to impose a timeout or deadline on the read operation from the client during this negotiation phase. Consequently, if a client initiates the SASL exchange and subsequently halts communication without completing the handshake, the server remains in a state of indefinite expectation.\nBecause the server lacks a mechanism to garbage collect these 'hanging' sessions, the resources associated with the connection remain pinned to the process lifecycle.\nAn attacker can systematically exploit this by opening numerous concurrent TCP connections to the MongoDB Connector for BI and initiating, but never finalizing, the SASL authentication sequence.\nEach connection consumes a dedicated worker thread and occupies a slot within the configured connection capacity. By flooding the listener with these incomplete requests, an attacker can rapidly saturate the service's connection limit.\nOnce the maximum threshold for connections or threads is reached, the service becomes unable to process new, legitimate authentication requests, leading to a complete Denial of Service.\nThe vulnerability is persistent, meaning that once the resource exhaustion is achieved, the server will continue to deny access even after the attacker ceases sending traffic, as the server maintains the zombie connections until it is explicitly restarted.\nThe vulnerability is accessible to any unauthenticated client with network visibility to the service, requiring no prerequisite knowledge, specialized payloads, or authenticated privileges. The primary requirement for exploitation is the ability to establish a standard TCP connection to the connector's port and initiate the expected SASL handshake protocol sequence."
}