# Pre-authentication message and buffer resource limits > Source-anchored research for Pre-authentication message and buffer resource limits. Run status: COMPLETED. Parent: [MongoDB Security Architecture](https://llms-explorer.com/tree/mongodb-security-architecture/) · 3 facets · 15 facts · page: https://llms-explorer.com/tree/pre-authentication-message-and-buffer-resource-limits/ ## How it works - Cato reports a pre-authentication allocation amplification mechanism in OP_COMPRESSED handling: the server allocates from attacker-controlled uncompressedSize before decompression. Its technical attack description says the payload genuinely decompresses to the claimed size and that buffers persist while connections remain open. Inference from that described test: rejecting inconsistent length fields alone does not account for the reported persistent-allocation behavior. (low confidence) — [source](https://www.catonetworks.com/blog/cato-ctrl-new-mongodb-vulnerability-cve-2026-25611/) - Canonical marks Ubuntu mongodb packages in Xenial and Trusty as not affected because the required message compression functionality is absent; it lists Focal and Bionic as vulnerable with fixes deferred. These are distribution-package assessments and do not establish the status of every upstream MongoDB build. (low confidence) (verified as of 2026-10-16) — [source](https://ubuntu.com/security/CVE-2026-25611) ## Problems, failure modes and limitations - capMemoryConsumptionForPreAuthBuffers defaults to 20 percent of memory available to the server. The r8.3.0 definition describes enforcement by adjusting the maximum accepted connections when necessary. This startup-only parameter accepts values greater than zero through 100; setting 100 disables this limitation. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/parameters.md) - messageSizeErrorRateSec defaults to 5 seconds and is startup-only. It controls the frequency of message-size errors logged at Info level; it does not specify a client request or error-response rate limit. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/parameters.md) - The r8.3.0 transport tests send an oversized declared message length using only a header and expect immediate ProtocolError plus an increment of totalMessageSizeErrorPreAuth. Separate tests allow post-authentication messages larger than the pre-auth limit, up to MaxMessageSizeBytes. (low confidence) — [source](https://raw.githubusercontent.com/mongodb/mongo/r8.3.0/src/mongo/transport/asio/asio_transport_layer_test.cpp) - SERVER-118428 records a mongocryptd regression affecting 8.2.4, 8.0.18, and 7.0.29: legitimate large requests exceeded the 16384-byte pre-auth limit because drivers do not authenticate to mongocryptd. The issue lists fixes in 8.3.0-rc0, 8.2.6, 8.0.20, and 7.0.31. (low confidence) (verified as of 2026-03-25) — [source](https://jira.mongodb.org/browse/SERVER-118428) - The r8.3.0 transport tests exercise immediate ProtocolError rejection after reading a header that advertises a message larger than the pre-authentication limit, and check that totalMessageSizeErrorPreAuth increments. Separate tests allow a message within that limit and allow a larger message when restricted mode is disabled to simulate authentication. (low confidence) — [source](https://raw.githubusercontent.com/mongodb/mongo/r8.3.0/src/mongo/transport/asio/asio_transport_layer_test.cpp) ## Facts and statements - MongoDB 8.3 groups capMemoryConsumptionForPreAuthBuffers, messageSizeErrorRateSec, and preAuthMaximumMessageSizeBytes as parameters limiting pre-authentication connection resource consumption; Percona also lists these controls for its own 8.3 release. (high confidence) (verified as of 2026-10-27) — [source](https://www.mongodb.com/docs/v8.3/release-notes/8.3/) - The parameter reference labels all three controls new in 8.3 and also available starting in 8.2.4, 8.0.18, and 7.0.29; these backports mean the controls are not exclusive to 8.3. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/reference/parameters.md) - preAuthMaximumMessageSizeBytes defaults to 16384 bytes (16 KiB) and can be changed at startup or runtime. The r8.3.0 parameter definition enforces a minimum of 1024 bytes. (high confidence) — [source](https://www.mongodb.com/docs/manual/reference/parameters.md) - MongoDB’s security alert identifies CVE-2026-25611 as unauthenticated message-driven memory-exhaustion denial of service and lists affected 8.2, 8.0, and 7.0 branches before 8.2.4, 8.0.18, and 7.0.29 respectively. Cato separately reports researching the flaw and describes its ability to crash a server. (high confidence) (verified as of 2026-10-29) — [source](https://www.mongodb.com/resources/products/alerts) - In the r8.3.0 parameter definitions, preAuthMaximumMessageSizeBytes defaults to 16384 bytes (16 KiB) and can be changed at startup or runtime; it limits message size before a session authenticates. (medium confidence) — [source](https://www.mongodb.com/docs/manual/reference/parameters.md) - The r8.3.0 definition requires preAuthMaximumMessageSizeBytes to be at least 1024 bytes. (low confidence) — [source](https://raw.githubusercontent.com/mongodb/mongo/r8.3.0/src/mongo/transport/transport_options.idl) - CVE-2026-25611 concerns denial of service from crafted unauthenticated messages that exhaust MongoDB server memory. Cato describes compressed-message memory amplification; Canonical independently assesses affected Ubuntu packages and identifies message compression as a prerequisite. (medium confidence) (verified as of 2026-10-16) — [source](https://www.catonetworks.com/blog/cato-ctrl-new-mongodb-vulnerability-cve-2026-25611/) - Cato reports tests of MongoDB 8.0 in Docker containers in which compressed messages caused large per-connection allocations. Its production and Atlas sizing table is explicitly an extrapolation, so those estimates should not be treated as independently measured service-wide crash thresholds. (low confidence) (verified as of 2026-03-04) — [source](https://www.catonetworks.com/blog/cato-ctrl-new-mongodb-vulnerability-cve-2026-25611/)