CVE-2025-13643— MongoDB Server may allow queries to be terminated by unauthorized users
Quick assessment
Affected
MongoDB Inc. MongoDB Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB Server是美国MongoDB公司的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server v7.0版本至7.0.26之前版本和8.0版本至8.0.14之前版本存在安全漏洞，该漏洞源于权限有限的集群用户可以终止其他用户执行的查询，可能导致拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-13643
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MongoDB Server may allow queries to be terminated by unauthorized users
Source: CVE Program / CVE List V5
Vulnerability Description
A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB Server是美国MongoDB公司的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server v7.0版本至7.0.26之前版本和8.0版本至8.0.14之前版本存在安全漏洞，该漏洞源于权限有限的集群用户可以终止其他用户执行的查询，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB Inc. | MongoDB Server | 8.0 ~ 8.0.14 | - |
|
II. Public POCs for CVE-2025-13643
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-13643
请登录查看更多情报信息。
Same Patch Batch · MongoDB Inc. · 2025-11-25 · 4 CVEs total
| CVE-2025-13507 | 6.5 MEDIUM | Time-series operations may cause internal BSON size limit to be exceed |
| CVE-2025-13644 | 6.5 MEDIUM | MongoDB may be susceptible to Invariant Failure due to batched delete |
| CVE-2025-12893 | 4.2 MEDIUM | Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Exten |
IV. Related Vulnerabilities
Same product: MongoDB Server
-
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads -
CVE-2026-82076
Integer Overflow in Query Planner Leads to Unbounded Memory -
CVE-2026-82075
Uncontrolled Resource Consumption in MongoDB Sharded Cluster -
CVE-2026-82074
Incorrect Authorization in MongoDB Server Aggregation Framew -
CVE-2026-82071
Insufficient Validation of Storage Engine Configuration Opti
Same vendor: MongoDB Inc.
-
CVE-2026-93759
Server-side JavaScript injection via string query criteria b -
CVE-2026-93760
NoSQL injection of JavaScript-executing query operators via -
CVE-2026-93761
Denial of service via unbounded regex matching in Mongoid's -
CVE-2026-93762
Data deletion and attribute disclosure via field-name method -
CVE-2026-93763
Silent plaintext persistence via unresolved callable databas
Same weakness: CWE-862
-
CVE-2026-11601
WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated -
CVE-2026-94505
Nelio Content <= 4.5.0 - Missing Authorization to Authentica -
CVE-2026-101923
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorizat -
CVE-2026-97337
Simple Membership <= 4.8.3 - Missing Authorization to Unauth -
CVE-2026-91108
Alt Text AI <= 1.10.41 - Missing Authorization to Authentica
V. Comments for CVE-2025-13643
No comments yet