STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must limit the total number of concurrent connections to the database.

DISA Rule

SV-279331r1179501_rule

Vulnerability Number

V-279331

Group Title

SRG-APP-000001-DB-000031

Rule Version

MD8X-00-000150

Severity

CAT III

CCI(s)

CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

Fix Recommendation

MongoDB can limit the total number of connections served by the mongod process by setting the following in the MongoDB configuration file (default location: /etc/mongod.conf):

net:
maxIncomingConnections: %int%

Refer to the following documentation:
https://www.mongodb.com/docs/manual/reference/configuration-options/

Products outside of MongoDB can be used to monitor database sessions and limit the maximum number of connections that can be made.

Alternatively, most Unix-like operating systems, including Linux and macOS, provide ways to limit and control the usage of system resources such as threads, files, and network connections on a per-process and per-user basis.

These ulimits prevent single users from using too many system resources.

The following is the MongoDB documentation regarding these user limits: https://www.mongodb.com/docs/manual/reference/ulimit/.

Check Contents

Mongo can limit the total number of connections.

Verify the MongoDB configuration file (default location: /etc/mongod.conf) contains the following:

net:
maxIncomingConnections: %int%

If this parameter is not present, or the OS is not used to limit connections, this is a finding.

Vulnerability Number

V-279331

Documentable

False

Rule Version

MD8X-00-000150

Severity Override Guidance

Check Content Reference

Target Key

5728