CVE-2025-13507CWE-1284

CVE-2025-13507

Medium · published November 25, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00285 · 20.0th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2025-11-25T10:16Z
Affected products (3)
ProductVersionsFixed in
mongodb/mongodb≥ 7.0.0, < 7.0.267.0.26
mongodb/mongodb≥ 8.0.0, < 8.0.168.0.16
mongodb/mongodb≥ 8.2.0, < 8.2.18.2.1
References (1)
https://jira.mongodb.org/browse/SERVER-108565 · [email protected]
EPSS history
Timeline
  • 25 NOV 04:52Z
    Time-series operations may cause internal BSON size limit to be exceed
    cvelistv5