CVE-2025-13643

MongoDB Server may allow queries to be terminated by unauthorized users

2.3LowCVSS base score
0.24%Exploitation in 30 daysEPSS · top 85% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14

Timeline

2025
25 Nov 2025
25 Nov 2025
ID reserved
By mongodb
25 Nov 2025
25 Nov 2025
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-13643, by who scored it
Scored by	CVSS	Score	Vector
mongodbCNA (assigner)	4.0	Low2.3	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
mongodbCNA (assigner)	3.1	Low3.1	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
NVDNVD · Analyzed	4.0	Low2.3	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.24% · top 85% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.

Affected products

MongoDB Inc. · MongoDB Server
- affected 8.0 – < 8.0.14
- affected 7.0 – < 7.0.26

References1

https://jira.mongodb.org/browse/SERVER-103582 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-13643](https://cveledger.app/badge/CVE-2025-13643.svg)](https://cveledger.app/cve/CVE-2025-13643)

Record last updated 25 Nov 2025, 16:41 UTC.