CVE-2025-14345

The record

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.

Affected packages

Related vulnerabilities

• CVE-2025-13643 A user with access to the cluster with a limited set of privilege actions may be able to… Also affects mongodb
• CVE-2025-13644 MongoDB Server may experience an invariant failure during batched delete operations when… Also affects mongodb
• CVE-2025-13507 Inconsistent object size validation in time series processing logic may result in later… Also affects mongodb
• CVE-2025-12893 Clients may successfully perform a TLS handshake with a MongoDB server despite presenting… Also affects mongodb
• CVE-2025-12657 The KMIP response parser built into mongo binaries is overly tolerant of certain… Also affects mongodb
• CVE-2024-8305 prepareUnique index may cause secondaries to crash due to incorrect enforcement of index… Also affects mongodb
• CVE-2024-7553 Incorrect validation of files loaded from a local untrusted directory may allow local… Also affects mongodb
• CVE-2024-3372 Improper validation of certain metadata input may result in the server not correctly… Also affects mongodb