CVE-2025-14345

A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.

This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.

References

https://jira.mongodb.org/browse/SERVER-106075

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/mongo

Events

Introduced

37d84072b5c5b9fd723db5fa133fb202ad2317f1

Fixed

cfe96f2560c2000d837880f3e49086bed560abec

Introduced

b41cda4fe697dce6fd9b83b3805362ccc02fbeb3

Fixed

6649991c993da79c269e52beec51274bf53fbb98

Introduced

b993867dce63dd366cd93e60f3f425ed716f6497

Fixed

d4511d28ec0c73f0c476027a943c0176c8a16f02

Introduced

Last affected

f363edefb03efa1e3e012d90aea1494c7770e8cc

Database specific

{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.26"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.16"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.3.0-alpha0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14345.json"

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "169396510644917166107972285471505278925",
            "length": 5523.0
        },
        "source": "https://github.com/mongodb/mongo/commit/cfe96f2560c2000d837880f3e49086bed560abec",
        "id": "CVE-2025-14345-0d7700d5",
        "target": {
            "file": "src/mongo/util/net/ssl_manager_windows.cpp",
            "function": "validatePeerCertificate"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "255094620203238166973302767875286180987",
                "311318788437859314187108745684874069447",
                "13195629967762718487111799273423913192",
                "145659902616350294817239749199959363992",
                "221972074441494021565962355714822796262",
                "48835208987546656192845547932509644477",
                "87708939807646049295739831013123777386",
                "10193593850898967193818537886210518552",
                "331231889353555350497810337678926637920",
                "152234860073312542299676805758359870241"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/mongodb/mongo/commit/cfe96f2560c2000d837880f3e49086bed560abec",
        "id": "CVE-2025-14345-1ac5af1d",
        "target": {
            "file": "src/mongo/util/net/ssl_manager_windows.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "52207717764756858887103230689427858974",
                "241284099896496899084843301553798842386",
                "81015194422365157642401834775353309989",
                "306832239360780013917147226125039650941"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/mongodb/mongo/commit/cfe96f2560c2000d837880f3e49086bed560abec",
        "id": "CVE-2025-14345-5d8a373e",
        "target": {
            "file": "src/mongo/util/net/ssl_manager_apple.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "60854262378866240810463600752329606435",
            "length": 715.0
        },
        "source": "https://github.com/mongodb/mongo/commit/cfe96f2560c2000d837880f3e49086bed560abec",
        "id": "CVE-2025-14345-a2bd2a3d",
        "target": {
            "file": "src/mongo/util/net/ssl_manager_apple.cpp",
            "function": "CreateSecTrustPolicies"
        }
    }
]