CVE-2025-14345: Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.
This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14345?
CVE-2025-14345 is categorized as a moderate severity vulnerability due to the potential for logical data inconsistencies.
How do I fix CVE-2025-14345?
To fix CVE-2025-14345, upgrade MongoDB Server to version 8.0.16 or later, or 7.0.26 or later.
What versions of MongoDB Server are affected by CVE-2025-14345?
CVE-2025-14345 affects MongoDB Server versions prior to 8.0.16, 7.0.26, and 8.2.2.
What type of systems are impacted by CVE-2025-14345?
CVE-2025-14345 impacts systems utilizing the MongoDB Server for cross-shard transactions.
Is CVE-2025-14345 an authentication issue?
CVE-2025-14345 is not an authentication issue but a post-authentication flaw affecting data consistency.