CVE-2025-14345
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact. This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
Scoring
- Severity
- LOW
- CVSS base score
- 4.2
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.22%
- CWE
- CWE-667
- Published
- 2025-12-09
- Last modified
- 2026-03-12
Affected products
- MongoDB Inc. MongoDB Server
- MongoDB Inc. MongoDB Server
- MongoDB Inc. MongoDB Server
Weakness type
Related vulnerabilities
- CVE-2026-80126 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-45404 — OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
- CVE-2026-54906 — concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
- CVE-2026-24182 — NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak...
- CVE-2026-20065 — Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability
- CVE-2026-20757 — Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged...
- CVE-2026-21914 — Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash
- CVE-2025-68657 — espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path