AIKIDO-2026-67736

TL;DR

The MongoDB honeypot module reads wire-protocol message-length fields from incoming connections without validating them against a sane maximum, and unpacks framing lengths as signed integers. A single crafted packet with a malformed or oversized length field drives the parser into an unbounded loop that consumes an entire CPU core in the Twisted process, stalling the service for unauthenticated remote clients. The fix validates message and buffer lengths against a maximum size, unpacks length fields as unsigned integers, closes the connection on invalid lengths or buffer-overflow attempts, and adds an idle-connection timeout.