PT-2025-49980 · Mongodb+1 · Mongodb Server+2

Published 2025-12-09 · Updated 2026-05-13 · CVE-2025-14345

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 8.0.16 MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.2.2

Description A flaw exists in the network two-phase commit protocol used for cross-shard transactions. This issue can lead to logical data inconsistencies under specific conditions that are not predictable and exist for a short duration. The transaction coordination logic may incorrectly interpret a transaction as committed, resulting in an inconsistent state across shards, potentially impacting data integrity and availability.

Recommendations Update MongoDB Server to version 8.0.16 or later. Update MongoDB Server to version 7.0.26 or later. Update MongoDB Server to version 8.2.2 or later.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2025-16095

BIT-MONGODB-2025-14345

CVE-2025-14345

Affected Products

Mongodb Server

Mongodb

Red Os

References · 12

• https://bdu.fstec.ru/vul/2025-16095 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14345 · Vendor Advisory
• https://jira.mongodb.org/browse/SERVER-106075 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2025-14345 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14345 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14345 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-14345 · Security Note
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cveNotify/145472 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mongodb-org-cve-2025-14345-7.3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14345 · Note