Pre-authentication message and buffer resource limits
Parent: MongoDB Security Architecture · Published reference · snapshot 2026-10-29
↓ Facts as markdownall context files
Source-anchored research for Pre-authentication message and buffer resource limits. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Cato reports a pre-authentication allocation amplification mechanism in OP_COMPRESSED handling: the server allocates from attacker-controlled uncompressedSize before decompression. Its technical attack description says the payload genuinely decompresses to the claimed size and that buffers persist while connections remain open. Inference from that described test: rejecting inconsistent length fields alone does not account for the reported persistent-allocation behavior. (low confidence) [source]
- Canonical marks Ubuntu mongodb packages in Xenial and Trusty as not affected because the required message compression functionality is absent; it lists Focal and Bionic as vulnerable with fixes deferred. These are distribution-package assessments and do not establish the status of every upstream MongoDB build. (low confidence) (verified as of 2026-10-16) [source]
Problems, failure modes and limitations
- capMemoryConsumptionForPreAuthBuffers defaults to 20 percent of memory available to the server. The r8.3.0 definition describes enforcement by adjusting the maximum accepted connections when necessary. This startup-only parameter accepts values greater than zero through 100; setting 100 disables this limitation. (high confidence) [source]
- messageSizeErrorRateSec defaults to 5 seconds and is startup-only. It controls the frequency of message-size errors logged at Info level; it does not specify a client request or error-response rate limit. (high confidence) [source]
- The r8.3.0 transport tests send an oversized declared message length using only a header and expect immediate ProtocolError plus an increment of totalMessageSizeErrorPreAuth. Separate tests allow post-authentication messages larger than the pre-auth limit, up to MaxMessageSizeBytes. (low confidence) [source]
- SERVER-118428 records a mongocryptd regression affecting 8.2.4, 8.0.18, and 7.0.29: legitimate large requests exceeded the 16384-byte pre-auth limit because drivers do not authenticate to mongocryptd. The issue lists fixes in 8.3.0-rc0, 8.2.6, 8.0.20, and 7.0.31. (low confidence) (verified as of 2026-03-25) [source]
- The r8.3.0 transport tests exercise immediate ProtocolError rejection after reading a header that advertises a message larger than the pre-authentication limit, and check that totalMessageSizeErrorPreAuth increments. Separate tests allow a message within that limit and allow a larger message when restricted mode is disabled to simulate authentication. (low confidence) [source]
Facts and statements
- MongoDB 8.3 groups capMemoryConsumptionForPreAuthBuffers, messageSizeErrorRateSec, and preAuthMaximumMessageSizeBytes as parameters limiting pre-authentication connection resource consumption; Percona also lists these controls for its own 8.3 release. (high confidence) (verified as of 2026-10-27) [source]
- The parameter reference labels all three controls new in 8.3 and also available starting in 8.2.4, 8.0.18, and 7.0.29; these backports mean the controls are not exclusive to 8.3. (high confidence) (verified as of 2026-10-14) [source]
- preAuthMaximumMessageSizeBytes defaults to 16384 bytes (16 KiB) and can be changed at startup or runtime. The r8.3.0 parameter definition enforces a minimum of 1024 bytes. (high confidence) [source]
- MongoDB’s security alert identifies CVE-2026-25611 as unauthenticated message-driven memory-exhaustion denial of service and lists affected 8.2, 8.0, and 7.0 branches before 8.2.4, 8.0.18, and 7.0.29 respectively. Cato separately reports researching the flaw and describes its ability to crash a server. (high confidence) (verified as of 2026-10-29) [source]
- In the r8.3.0 parameter definitions, preAuthMaximumMessageSizeBytes defaults to 16384 bytes (16 KiB) and can be changed at startup or runtime; it limits message size before a session authenticates. (medium confidence) [source]
- The r8.3.0 definition requires preAuthMaximumMessageSizeBytes to be at least 1024 bytes. (low confidence) [source]
- CVE-2026-25611 concerns denial of service from crafted unauthenticated messages that exhaust MongoDB server memory. Cato describes compressed-message memory amplification; Canonical independently assesses affected Ubuntu packages and identifies message compression as a prerequisite. (medium confidence) (verified as of 2026-10-16) [source]
- Cato reports tests of MongoDB 8.0 in Docker containers in which compressed messages caused large per-connection allocations. Its production and Atlas sizing table is explicitly an extrapolation, so those estimates should not be treated as independently measured service-wide crash thresholds. (low confidence) (verified as of 2026-03-04) [source]
Children
- Pre-authentication message size validation (frontier)
- Pre-authentication network buffer admission budget (frontier)
- Message-size error log throttling (frontier)
- Aggregate pre-authentication buffer memory budgeting (frontier)
Frontier under this node: Aggregate pre-authentication buffer memory budgeting, Message-size error log throttling, Pre-authentication message size validation, Pre-authentication network buffer admission budget