CVE-2025-13644

The record

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2

Affected packages

Related vulnerabilities

• CVE-2025-14345 A post-authentication flaw in the network two-phase commit protocol used for cross-shard… Also affects mongodb
• CVE-2025-13643 A user with access to the cluster with a limited set of privilege actions may be able to… Also affects mongodb
• CVE-2025-13507 Inconsistent object size validation in time series processing logic may result in later… Also affects mongodb
• CVE-2025-12893 Clients may successfully perform a TLS handshake with a MongoDB server despite presenting… Also affects mongodb
• CVE-2025-12657 The KMIP response parser built into mongo binaries is overly tolerant of certain… Also affects mongodb
• CVE-2024-8305 prepareUnique index may cause secondaries to crash due to incorrect enforcement of index… Also affects mongodb
• CVE-2024-7553 Incorrect validation of files loaded from a local untrusted directory may allow local… Also affects mongodb
• CVE-2024-3372 Improper validation of certain metadata input may result in the server not correctly… Also affects mongodb