Query filter with multiple `_id` fields are not handled correctly

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 8.2.0-rc0, 8.1.1
    • Affects Version/s: None
    • Component/s: None
    • None
    • Query Execution
    • Fully Compatible
    • ALL
    • v8.1, v8.0
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      CVE ID:

      CVE-2025-7259

      Title: 

      Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash

      Description:

      An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

      CVSS Score:

      6.5 - https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 

      List all affected product versions:

      8.1.0

      CWE:

      CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

            Assignee:
            Projjal Chanda
            Reporter:
            Projjal Chanda
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: