Overview
CVE-2025-13644 is a medium severity vulnerability affecting MongoDB Server. This flaw can cause an invariant failure during batched delete operations, potentially leading to unexpected behavior and data inconsistencies. The vulnerability stems from an incorrect assumption about the number of documents in a batch based on document size exceeding the `BSONObjMaxSize` setting.
Technical Details
The issue arises during batched delete operations within MongoDB Server. The server, when handling documents for deletion, incorrectly infers the presence of multiple documents in a batch solely based on the document size surpassing the configured `BSONObjMaxSize`. This flawed logic can trigger an invariant failure, interrupting the deletion process and potentially leaving the database in an inconsistent state.
This vulnerability affects the following MongoDB Server versions:
- v7.0 versions prior to 7.0.26
- v8.0 versions prior to 8.0.13
- v8.1 versions prior to 8.1.2
CVSS Analysis
The vulnerability has a CVSS score of 6.5, indicating a MEDIUM severity. This score reflects the potential for exploitation and the impact on system availability and data integrity.
Possible Impact
Exploitation of CVE-2025-13644 can lead to the following:
- Invariant Failure: The server may encounter an unexpected failure during delete operations, causing the process to halt.
- Data Inconsistency: The deletion process may be interrupted, potentially leaving the database in an inconsistent state with some documents deleted while others remain.
- Denial of Service (DoS): While not a direct DoS, repeated triggering of the vulnerability could lead to performance degradation or instability.
Mitigation and Patch Steps
The recommended mitigation is to upgrade your MongoDB Server to one of the following patched versions:
- MongoDB Server v7.0.26 or later
- MongoDB Server v8.0.13 or later
- MongoDB Server v8.1.2 or later
Follow the official MongoDB upgrade documentation for detailed instructions on performing the upgrade safely and effectively. Regularly apply security patches to your MongoDB instances to protect against known vulnerabilities.
