PT-2025-47990 · Mongodb+1 · Mongodb Server+2

CVE-2025-13643 · Published 2025-11-25 · Updated 2025-12-19

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.14

Description A user with limited privileges within a cluster may be able to terminate queries initiated by other users. This could lead to a denial of service by preventing some queries from completing successfully.

Recommendations Update MongoDB Server to version 7.0.26 or later. Update MongoDB Server to version 8.0.14 or later.

Exploit

Fix

LPE

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-00269

BIT-MONGODB-2025-13643

CVE-2025-13643

Affected Products

Mongodb Server

Mongodb

Red Os

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13643.json · Exploit
• https://jira.mongodb.org/browse/SERVER-103582 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00269 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13643 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13643 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-13643 · Security Note
• https://ubuntu.com/security/CVE-2025-13643 · Vendor Advisory
• https://t.me/cveNotify/145520 · Telegram Post
• https://t.me/CVEtracker/38163 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-cve-2025-13643-7.3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13643 · Note
• https://t.me/cveNotify/143908 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993232917502259617 · Twitter Post