CVE-2025-13507
BaseFortify
Publication date: 2025-11-25
Last updated on: 2025-12-05
Assigner: MongoDB, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | mongodb | From 7.0.0 (inc) to 7.0.26 (exc) |
| mongodb | mongodb | From 8.0.0 (inc) to 8.0.16 (exc) |
| mongodb | mongodb | From 8.2.0 (inc) to 8.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by inconsistent validation of object sizes in the time series processing logic of MongoDB Server. It may allow oversized BSON documents to be processed later than expected, which can trigger an assertion failure and cause the MongoDB process to terminate unexpectedly.
How can this vulnerability impact me? :
The impact of this vulnerability is that it can cause the MongoDB server process to terminate unexpectedly due to assertion failures when processing oversized BSON documents. This can lead to denial of service, disrupting availability of the database service.