CVE-2025-10060 json
MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation
published last yr. modified last mo. also BIT-mongodb-2025-10060 , EUVD-2025-27035
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12
Patch / fix
- bitnami mongodb 6.0.25, 7.0.22, 8.0.12
- MongoDB Inc MongoDB Server 6.0.25, 7.0.22, 8.0.12
Is CVE-2025-10060 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=6.0.0, <6.0.25 >=7.0.0, <7.0.22 >=8.0.0, <8.0.12 |
6.0.25 7.0.22 8.0.12 |
Affected products
- MongoDB Inc MongoDB Server
Classification
- Weakness
-
- CWE-672 Operation on a Resource after Expiration or Release
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-95524
issue-tracking, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-10060
web
Sources
- CVE List CVE-2025-10060
- NVD CVE-2025-10060
- OSV BIT-mongodb-2025-10060
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.