CVE-2025-13644 - CVE House

Back to Database

Status published High CVE-2025-13644

MongoDB may be susceptible to Invariant Failure due to batched delete

7.1 CVSS

Vulnerability Description

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13644

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://jira.mongodb.org/browse/SERVER-101180

More from MongoDB Inc.

View All →

Zlib compressed protocol header length confusion may allow memory read

Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

MongoDB Server may allow queries to be terminated by unauthorized users

Time-series operations may cause internal BSON size limit to be exceed

Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

Affected Vendor

MongoDB Inc.

View all reports →

Affected Software

MongoDB Server

Vulnerable Versions:

8.0, 7.0, 8.1

Timeline

Official Publish: November 25th, 2025

Last Modified: November 25th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1562 Impair Defenses

Defense Evasion

T1485 Data Destruction