Threats Tagged 'cve-2025-12893'
View all threats tagged with 'cve-2025-12893'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2025-12893'
Click on any threat for detailed analysis and mitigation recommendations
MongoDB Server versions prior to 7.0.26, 8.0.16, and 8.2.2 on Windows and Apple platforms improperly validate Extended Key Usage (EKU) fields during TLS handshakes. This allows clients or servers with certificates missing the required EKU attributes (clientAuth or serverAuth) to successfully complete TLS handshakes. Linux systems are not affected by this issue. The vulnerability has been fixed in the specified later versions. Join the discussion | GCVE Database | 12/06/2025, 11:42:47 UTC Added: 09/10/2026, 22:05:04 UTC |
0 Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2 Join the discussion | CVE Database V5 | 11/25/2025, 05:07:17 UTC Added: 11/25/2025, 05:13:56 UTC |
Showing 1 to 2 of 2 results