CVE-2025-14345 - CVE House
Back to Database
Status published Low CVE-2025-14345

Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

Vulnerability Description

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14345

Credits & Attribution

No credits recorded in the NVD database.

References

More from MongoDB Inc.

View All →
CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
High 8.7
CVE-2025-13644
MongoDB may be susceptible to Invariant Failure due to batched delete
High 7.1
CVE-2025-13643
MongoDB Server may allow queries to be terminated by unauthorized users
Low 2.3
CVE-2025-13507
Time-series operations may cause internal BSON size limit to be exceed
High 7.1
CVE-2025-12893
Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server
Low 2.3

Affected Vendor

MongoDB Inc.

View all reports →

Affected Software

MongoDB Server
Vulnerable Versions:
7.0, 8.0, 8.2

Timeline

Official Publish: December 9th, 2025
Last Modified: December 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-667

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.