CVE-2025-11979
- Source
- https://cve.org/CVERecord?id=CVE-2025-11979
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11979.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-11979
- Aliases
- Downstream
UBUNTU (1)
- Published
- 2025-10-20T17:47:57Z
- Modified
- 2026-10-24T14:46:10Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior
- Details
-
An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.
- Database specific
{ "cna_assigner": "mongodb", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11979.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "8.2.0" }, { "last_affected": "8.2.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" } ] }, { "extracted_events": [ { "range": [ { "introduced": "8.0.0" }, { "fixed": "8.0.14" }, { "introduced": "7.0.0" }, { "fixed": "7.0.25" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
Affected packages
Git / github.com/mongodb/mongo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mongodb/mongo
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "range": [ { "introduced": "7.0.0" }, { "fixed": "7.0.25" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "range": [ { "introduced": "8.0.0" }, { "fixed": "8.0.15" } ], "source": "CPE_RANGE" } ] }
Affected versions
r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.10
r7.0.10-rc0
r7.0.11
r7.0.11-rc0
r7.0.11-rc1
r7.0.11-rc2
r7.0.12
r7.0.12-rc0
r7.0.12-rc1
r7.0.13
r7.0.13-rc0
r7.0.13-rc1
r7.0.14
r7.0.14-rc0
r7.0.15
r7.0.15-rc0
r7.0.15-rc1
r7.0.16
r7.0.16-rc0
r7.0.16-rc1
r7.0.17
r7.0.18
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.21
r7.0.21-alpha0
r7.0.21-rc0
r7.0.22
r7.0.22-rc0
r7.0.23
r7.0.23-rc0
r7.0.23-rc1
r7.0.24
r7.0.24-rc0
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0
r7.0.6
r7.0.6-rc0
r7.0.7
r7.0.7-rc0
r7.0.7-rc1
r7.0.7-rc2
r7.0.8
r7.0.8-rc0
r7.0.9
r7.0.9-rc0
r7.0.9-rc1
r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.2
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11979.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "207746915935755901409177545814325694944",
"length": 960
},
"id": "CVE-2025-11979-19a377c6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/planner_wildcard_helpers.cpp",
"function": "createExpandedIndexEntry"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "103931629811240667501640691117780298753",
"length": 1782
},
"id": "CVE-2025-11979-2e5d61b6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/get_executor.cpp",
"function": "indexEntryFromIndexCatalogEntry"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "313500332486946680836394064952321316826",
"length": 1984
},
"id": "CVE-2025-11979-420eda93",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/get_executor.cpp",
"function": "fillOutPlannerParams"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"189333303470414706517825545515678200768",
"202919072866983895184691397030865194088",
"315557802260874947528313451448176834900",
"213622594336086705187192313499455539893"
],
"threshold": 0.9
},
"id": "CVE-2025-11979-72e1195c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/collection_query_info.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"92962458784834529095991261222802572218",
"10889385907757927774594482802996489623",
"51304199389515465112311427659341979754",
"137320233105713572959093475235010952343",
"20958512346721825150691381592188653935",
"8355927234414056083615585017803640279",
"88714960816890483704528690881180875038",
"116191926195465827553798223912128566240",
"101035699814577416952505891507270668057",
"125738533707253302180331506569450924880",
"142997261311567140595765660057946276876"
],
"threshold": 0.9
},
"id": "CVE-2025-11979-987846f6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/get_executor.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"244092128141109068790597833792771869962",
"131807433502334542792340552702236492782",
"308056450644446876092685883131166640220",
"244132815259624924083936790072081489188",
"48358986428327356352711446765550927141",
"217205618164515642292517146053277816938",
"109085097479535235270918539708416645068",
"1544229181798411985602566205969908148",
"247188723388188276932696073133141437086",
"18395115849396421515366202427440307678",
"329788468375456331314988268318012312465",
"333677887994342152542488209526436378187",
"333394532223339169168268344688074601256",
"306767205692433398240494373142606478614",
"229990481424514315064830048501881972140",
"48544630614827616360635971799160836221",
"150447868201959270518529828079962050573",
"220427871503775394596777991515307371461",
"601511317739815436423990688357856273",
"301210681512775426584528397068579248537",
"190394335184497810764056783078292109728",
"329716026598828168293921543505667556864",
"55941009747741831485899940034928560320",
"118469087764106956444219074765234226696",
"178895914867038080484832472600651426808"
],
"threshold": 0.9
},
"id": "CVE-2025-11979-9f9484c2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/index_entry.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"249051973705161421560899634600199076964",
"141740705175550341226340919871766281242",
"31797772635998441161542971107160448434",
"132974319488123001241350457859224821345"
],
"threshold": 0.9
},
"id": "CVE-2025-11979-b1cbcf31",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/planner_wildcard_helpers.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"79352476415990893297885829188788851702",
"96264135931572942438236247371943938867",
"205699743260697356860009613533201130928",
"327098372172384729150010102032791981328"
],
"threshold": 0.9
},
"id": "CVE-2025-11979-d287d2b9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/index_bounds_builder_test.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "332376735927461729386566008374621361924",
"length": 530
},
"id": "CVE-2025-11979-ee60286d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/39539342a1f82ca6835aad24aa6463060387481c",
"target": {
"file": "src/mongo/db/query/collection_query_info.cpp",
"function": "indexInfoFromIndexCatalogEntry"
}
}
]
vanir_signatures_modified
"2026-10-24T14:46:10Z"