PT-2025-47992 · Mongodb+1 · Mongodb Server+2

Published 2025-02-21 · Updated 2025-12-19 · CVE-2025-13644

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.13 MongoDB Server versions prior to 8.1.2

Description MongoDB Server may encounter an invariant failure during batched delete operations when processing documents. This occurs because the server incorrectly assumes multiple documents exist within a batch, relying solely on the document size exceeding the BSONObjMaxSize limit.

Recommendations Update MongoDB Server to version 7.0.26 or later. Update MongoDB Server to version 8.0.13 or later. Update MongoDB Server to version 8.1.2 or later.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2025-14799

BIT-MONGODB-2025-13644

CVE-2025-13644

Affected Products

Mongodb Server

Mongodb

Red Os

References · 17

• https://jira.mongodb.org/browse/SERVER-101180 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13644 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13644 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-13644 · Security Note
• https://ubuntu.com/security/CVE-2025-13644 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14799 · Security Note
• https://twitter.com/VulmonFeeds/status/1993230357559193924 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13644 · Note
• https://t.me/cveNotify/145521 · Telegram Post
• https://twitter.com/transilienceai/status/1995335093183795296 · Twitter Post
• https://t.me/CVEtracker/38164 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1995330874938634607 · Twitter Post
• https://twitter.com/CVEnew/status/1993196103647256665 · Twitter Post