CVE-2025-13644

Published: Nov 25, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2

Affected (7)

Products: Mongodb: Mongodb

Mongodb

1 product

Mongodb

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Mongodb Mongodb	From 7.0.0 to 7.0.26
Mongodb Mongodb	From 8.0.0 to 8.0.13
Mongodb Mongodb	From 8.1.0 to 8.1.2
Mongodb Mongodb	Version 8.2.0 alpha0
Mongodb Mongodb	Version 8.2.0 alpha1
Mongodb Mongodb	Version 8.2.0 alpha2
Mongodb Mongodb	Version 8.2.0 alpha

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (1)

https://jira.mongodb.org/browse/SERVER-101180

Source: cna@mongodb.com

Vendor Advisory

Timeline

No history available yet.