CVE-2025-13507 Overview
CVE-2025-13507 is a denial of service vulnerability in MongoDB Server affecting time series collection processing. Inconsistent object size validation allows oversized Binary JSON (BSON) documents to reach later processing stages, where an assertion fails and terminates the mongod process. The flaw impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16, and v8.2 versions prior to 8.2.1. An authenticated attacker with low privileges can trigger the assertion remotely over the network, causing service disruption.
Critical Impact
Authenticated attackers can crash MongoDB Server instances by submitting oversized BSON documents to time series collections, disrupting database availability.
Affected Products
- MongoDB Server v7.0 versions prior to 7.0.26
- MongoDB Server v8.0 versions prior to 8.0.16
- MongoDB Server v8.2 versions prior to 8.2.1
Discovery Timeline
- 2025-11-25 - CVE-2025-13507 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13507
Vulnerability Analysis
The vulnerability resides in the time series processing logic of MongoDB Server. BSON documents are validated for size at ingest, but the validation is inconsistent with checks performed later in the pipeline. Oversized documents bypass the initial gate and reach downstream processing stages that expect size-conformant input.
When the later stage encounters a document exceeding the expected size limit, an internal assertion fails. The failed assertion terminates the mongod process, causing an availability outage. The issue is classified under [CWE-1284] (Improper Validation of Specified Quantity in Input).
Exploitation requires network access and authenticated credentials with permissions to write to time series collections. No user interaction is required. The impact is limited to availability. Confidentiality and integrity are not affected.
Root Cause
The root cause is inconsistent enforcement of BSON object size limits across the time series processing pipeline. Early validation logic and later processing logic apply different size expectations. Documents that pass the earlier check reach code paths that treat oversized input as an invariant violation, triggering an assertion failure rather than a graceful error return.
Attack Vector
An authenticated client with write privileges to a time series collection submits a specially crafted BSON document that exceeds the size limit enforced by the downstream processing stage but passes the earlier validation. Processing of the document triggers the assertion and terminates the server process. Repeated exploitation prevents the server from remaining online, producing a sustained denial of service condition.
See the MongoDB Issue SERVER-108565 for vendor technical details.
Detection Methods for CVE-2025-13507
Indicators of Compromise
- Unexpected mongod process terminations with assertion failure messages in server logs
- Log entries referencing BSON size validation errors during time series write operations
- Repeated crashes correlated with write traffic to time series collections from a specific authenticated client
Detection Strategies
- Monitor MongoDB server logs for Fatal assertion or invariant failure messages associated with time series ingest paths
- Alert on abnormal mongod restart frequency, particularly on nodes hosting time series workloads
- Baseline BSON document sizes written to time series collections and flag outliers approaching or exceeding the 16 MB limit
Monitoring Recommendations
- Enable audit logging for write operations against time series collections and retain logs for correlation
- Track authentication events tied to accounts with write access to time series collections
- Forward MongoDB logs to a centralized SIEM to correlate crashes with client identity, source IP, and payload characteristics
How to Mitigate CVE-2025-13507
Immediate Actions Required
- Upgrade MongoDB Server to version 7.0.26, 8.0.16, 8.2.1, or later depending on the deployed major version
- Audit accounts with write privileges to time series collections and revoke unnecessary access
- Review server logs for prior assertion failures indicating possible exploitation attempts
Patch Information
MongoDB has released fixed versions that enforce consistent BSON size validation in time series processing. Upgrade to MongoDB Server 7.0.26, 8.0.16, or 8.2.1. Refer to MongoDB Issue SERVER-108565 for release notes and remediation guidance.
Workarounds
- Restrict network access to mongod instances to trusted application tiers only
- Apply least-privilege role assignments so that only required service accounts can write to time series collections
- Deploy replica sets with automatic failover to reduce the availability impact if a primary node crashes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
