PT-2025-47990 · Mongodb+1 · Mongodb Server+2

Published 2025-11-25 · Updated 2025-12-19 · CVE-2025-13643

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.14

Description A user with limited privileges within a cluster may be able to terminate queries initiated by other users. This could lead to a denial of service by preventing some queries from completing successfully.

Recommendations Update MongoDB Server to version 7.0.26 or later. Update MongoDB Server to version 8.0.14 or later.

Fix

DoS

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-00269

BIT-MONGODB-2025-13643

CVE-2025-13643

Affected Products

Mongodb Server

Mongodb

Red Os

References · 15

• https://cve.org/CVERecord?id=CVE-2025-13643 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13643 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13643 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-103582 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13643 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00269 · Security Note
• https://t.me/cveNotify/145520 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-cve-2025-13643-7.3 · Note
• https://t.me/cveNotify/143908 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13643 · Note
• https://t.me/CVEtracker/38163 · Telegram Post
• https://twitter.com/CVEnew/status/1993196104641302707 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993232917502259617 · Twitter Post