CVE-2025-13644: MongoDB may be susceptible to Invariant Failure due to batched delete
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13644?
The severity of CVE-2025-13644 is classified as high due to its potential to cause invariant failures during batched delete operations.
How do I fix CVE-2025-13644?
To fix CVE-2025-13644, update MongoDB Server to version 7.0.26 or later, or 8.0.13 or later.
What systems are affected by CVE-2025-13644?
CVE-2025-13644 affects MongoDB Server versions prior to 7.0.26, 8.0.13, and 8.1.2.
What are the potential risks of CVE-2025-13644?
The potential risks of CVE-2025-13644 include data loss and application crashes during batched delete operations.
Is there a workaround for CVE-2025-13644?
Currently, there are no recommended workarounds for CVE-2025-13644 aside from upgrading to the patched versions.