CVE-2025-10060

MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

State: Published
Severity: 6.5 Medium
Published: Sep 5, 2025
Updated: Sep 5, 2025
Reserved: Sep 5, 2025

Description

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	mongodb

Weaknesses

CWE-672 Operation on a Resource after Expiration or Release

Affected Products

Product	Versions
MongoDB ServerMongoDB Inc	6.0 to before 6.0.25Affected 7.0 to before 7.0.22Affected 8.0 to before 8.0.12Affected

References

https://jira.mongodb.org/browse/SERVER-95524

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.