CVE-2025-13644

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136457.2The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax CVE-2025-136466.6The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip CVE-2025-136486.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulne CVE-2025-136496.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the acti CVE-2025-13657.8A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file rea CVE-2025-136506.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action CVE-2025-136517.5Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of CVE-2025-136526.5The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, a CVE-2025-136534.3In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated CVE-2025-136547.5A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to tr CVE-2025-136566.4The Cute News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in all versions u CVE-2025-136574.3The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This