CVE-2025-10060
published 2025-09-05CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.38%
31.5th percentile
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 6.0.0 < 6.0.25 | 6.0.25 |
| mongodb | mongodb | >= 7.0.0 < 7.0.22 | 7.0.22 |
| mongodb | mongodb | >= 8.0.0 < 8.0.12 | 8.0.12 |
| mongodb_inc | mongodb_server | >= 6.0 < 6.0.25 | 6.0.25 |
| mongodb_inc | mongodb_server | >= 7.0 < 7.0.22 | 7.0.22 |
| mongodb_inc | mongodb_server | >= 8.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB Server up to 6.0.24/7.0.21/8.0.11 operation after expiration (EUVD-2025-27035 / Nessus ID 264357)
vuldb·2026-10-02·CVSS 7.5
CVE-2025-10060 [HIGH] MongoDB Server up to 6.0.24/7.0.21/8.0.11 operation after expiration (EUVD-2025-27035 / Nessus ID 264357)
A vulnerability identified as problematic has been detected in MongoDB Server up to 6.0.24/7.0.21/8.0.11. Affected by this issue is some unknown functionality. The manipulation leads to operation on a resource after expiration.
This vulnerability is documented as CVE-2025-10060. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
OSV
CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure
osv·2025-09-05·CVSS 7.5
CVE-2025-10060 [HIGH] CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12
GHSA
GHSA-95w4-863f-9mj3: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure
ghsa_unreviewed·2025-09-05
CVE-2025-10060 [MEDIUM] CWE-672 GHSA-95w4-863f-9mj3: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-05
Published