PT-2025-47989 · Mongodb+1 · Mongodb Server+2

Published 2025-11-25 · Updated 2025-12-19 · CVE-2025-13507

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.16 MongoDB Server versions prior to 8.2.1

Description An issue exists in the time series processing logic where inconsistent object size validation can lead to the processing of oversized BSON documents. This can cause an assertion failure and terminate the process.

Recommendations Update MongoDB Server to version 7.0.26 or later. Update MongoDB Server to version 8.0.16 or later. Update MongoDB Server to version 8.2.1 or later.

Fix

Weakness Enumeration

CWE-1284

Related Identifiers

BDU:2026-00270

BIT-MONGODB-2025-13507

CVE-2025-13507

Affected Products

Mongodb Server

Mongodb

Red Os

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-13507 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13507 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-108565 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00270 · Security Note
• https://ubuntu.com/security/CVE-2025-13507 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2025-13507 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-13507 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13507 · Vendor Advisory
• https://twitter.com/dailycve/status/1997077722527338519 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13507 · Note
• https://twitter.com/CVEnew/status/1993187159906324941 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-cve-2025-13507-7.3 · Note
• https://t.me/cveNotify/143901 · Telegram Post
• https://t.me/CVEtracker/38156 · Telegram Post