CVE-2025-13644
📋 TL;DR
MongoDB Server may crash due to an invariant failure during batched delete operations when handling documents. The server incorrectly assumes multiple documents exist in a batch based on document size exceeding BSONObjMaxSize, leading to a denial of service. This affects MongoDB Server v7.0 prior to 7.0.26, v8.0 prior to 8.0.13, and v8.1 prior to 8.1.2.
💻 Affected Systems
- MongoDB Server
📦 What is this software?
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash leading to sustained denial of service, requiring manual restart and potentially causing data corruption or loss.
Likely Case
Server crash resulting in temporary denial of service until automatic or manual restart, with possible transaction disruption.
If Mitigated
Minimal impact with proper monitoring and automated restart mechanisms in place.
🎯 Exploit Status
Requires authenticated database access and specific batched delete operations to trigger the invariant failure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v7.0.26, v8.0.13, v8.1.2
Vendor Advisory: https://jira.mongodb.org/browse/SERVER-101180
Restart Required: Yes
Instructions:
1. Download the patched version from MongoDB's official website. 2. Stop the MongoDB service. 3. Backup your data. 4. Install the patched version. 5. Restart the MongoDB service. 6. Verify the version is updated.
🔧 Temporary Workarounds
Disable batched delete operations
allPrevent the use of batched delete operations that could trigger the vulnerability.
Configure application code to avoid batched delete operations with large documents.
Document size monitoring
allMonitor and limit document sizes to prevent exceeding BSONObjMaxSize thresholds.
Implement application-level validation to reject documents exceeding size limits.
🧯 If You Can't Patch
- Implement strict access controls to limit who can perform delete operations.
- Deploy monitoring and alerting for server crashes with automated restart capabilities.
🔍 How to Verify
Check if Vulnerable:
Check MongoDB version using 'mongod --version' or 'db.version()' in mongo shell and compare against affected ranges.Check Version:
mongod --versionVerify Fix Applied:
After patching, verify version is v7.0.26+, v8.0.13+, or v8.1.2+ and test batched delete operations with large documents.📡 Detection & Monitoring
Log Indicators:
- Server crash logs with invariant failure messages
- Unexpected termination of mongod process
- Error logs mentioning batched delete operations
Network Indicators:
- Sudden drop in database connectivity
- Increased failed connection attempts
SIEM Query:
source="mongodb.log" AND ("invariant failure" OR "batched delete" OR "Fatal assertion")