CVE-2025-13644: high-severity vulnerability in MongoDB Server
MongoDB may be susceptible to Invariant Failure due to batched delete
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB Inc. · MongoDB ServerRelated CVEs — MongoDB Server
In the same product, most dangerous first.
CVE-2025-14847HIGHZlib compressed protocol header length confusion may allow memory readEPSS 83.2%KEVCVE-2021-32040MEDIUMLarge aggregation pipelines with a specific stage can crash mongod under default configurationEPSS 2.0%CVE-2020-7925HIGHDenial of Service when processing malformed Role namesEPSS 1.7%CVE-2019-20925HIGHDenial of service via malformed network packetEPSS 1.7%CVE-2018-20802MEDIUMPost-auth queries on compound index may crash mongodEPSS 1.6%CVE-2020-7928MEDIUMImproper neutralization of null byte leads to read overrunEPSS 1.4%