Inconsistent Object Size Validation in MongoDB Server
CVE-2025-13507

7.1HIGH

Key Information:

Vendor

MongoDB
Status
Mongodb Server
Vendor
CVE Published:
25 November 2025

What is CVE-2025-13507?

This vulnerability in MongoDB Server arises from inadequate validation of object sizes in the time series processing logic. It may allow oversized BSON documents to be processed incorrectly, leading to assertions failing and potential termination of the MongoDB process. This issue predominantly affects specific versions of MongoDB Server, which need urgent remediation to ensure continuous and reliable database operations.

Affected Version(s)

MongoDB Server 7.0 < 7.0.26

MongoDB Server 8.0 < 8.0.16

MongoDB Server 8.2 < 8.2.1

References

https://jira.mongodb.org/browse/SERVER-108565

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-13507 : Inconsistent Object Size Validation in MongoDB Server