CVE-2025-7259: Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash

Published Jul 7, 2025

Updated

An authorized user can issue queries with duplicate id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

Affected Software

2 affected components

MongoDB MongoDB Server

MongoDB MongoDB=8.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.0

Event History

Jul 7, 2025

CVE Published

via MITRE·03:59 PM

Data Sourced

via MITRE·03:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-7259?

CVE-2025-7259 is considered a moderate severity vulnerability that can lead to Denial of Service.

How do I fix CVE-2025-7259?

To fix CVE-2025-7259, update to the latest version of MongoDB Server that addresses this issue.

Who is affected by CVE-2025-7259?

CVE-2025-7259 affects authorized users of MongoDB Server v8.1 version 8.1.0.

What kind of behavior does CVE-2025-7259 trigger?

CVE-2025-7259 can trigger unexpected behavior in MongoDB Server, potentially causing a crash.

Is CVE-2025-7259 exploitable remotely?

CVE-2025-7259 is not remotely exploitable as it requires authorized user access to trigger the vulnerability.