CVE-2025-7259

Published: Jul 7, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: CNA (Secondary)

Description

An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

Affected (1)

Products: Mongodb: Mongodb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mongodb Mongodb	Version 8.1.0

Related CWEs

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (1)

https://jira.mongodb.org/browse/SERVER-102693

Source: cna@mongodb.com

Issue TrackingVendor Advisory

Timeline

No history available yet.