{"id":"CVE-2025-6709","details":"The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.\n\nThe same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.","aliases":["BIT-mongodb-2025-6709"],"modified":"2026-04-12T19:16:09.979020Z","published":"2025-06-26T14:15:35.463Z","references":[{"type":"REPORT","url":"https://jira.mongodb.org/browse/SERVER-106748"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb/mongo","events":[{"introduced":"e61bf27c2f6a83fed36e5a13c008a32d563babe2"},{"fixed":"f4184f18fe405b75258e85a8554481128fb46410"},{"introduced":"37d84072b5c5b9fd723db5fa133fb202ad2317f1"},{"fixed":"6951d91380daa05e54bb3cf02bd738c4be5b5673"},{"introduced":"b41cda4fe697dce6fd9b83b3805362ccc02fbeb3"},{"fixed":"07391eabd130b66d493b22cf46cb258acd7f290f"}],"database_specific":{"versions":[{"introduced":"6.0.0"},{"fixed":"6.0.21"},{"introduced":"7.0.0"},{"fixed":"7.0.17"},{"introduced":"8.0.0"},{"fixed":"8.0.5"}]}}],"versions":["r6.0.0","r6.0.1","r6.0.1-rc0","r6.0.10","r6.0.10-rc0","r6.0.11","r6.0.11-rc0","r6.0.12","r6.0.12-rc0","r6.0.12-rc1","r6.0.13","r6.0.13-rc0","r6.0.14","r6.0.14-rc0","r6.0.14-rc1","r6.0.15","r6.0.15-rc0","r6.0.16","r6.0.16-rc0","r6.0.17","r6.0.17-rc0","r6.0.18","r6.0.18-rc0","r6.0.19","r6.0.2","r6.0.2-rc0","r6.0.2-rc1","r6.0.20","r6.0.20-rc0","r6.0.20-rc1","r6.0.20-rc2","r6.0.20-rc3","r6.0.3","r6.0.3-rc0","r6.0.3-rc1","r6.0.3-rc2","r6.0.4","r6.0.4-rc0","r6.0.4-rc1","r6.0.5","r6.0.5-rc0","r6.0.5-rc1","r6.0.6","r6.0.6-rc0","r6.0.6-rc1","r6.0.7","r6.0.7-rc0","r6.0.8","r6.0.8-rc0","r6.0.9","r6.0.9-rc0","r6.0.9-rc1","r7.0.0","r7.0.1","r7.0.1-rc0","r7.0.10","r7.0.10-rc0","r7.0.11","r7.0.11-rc0","r7.0.11-rc1","r7.0.11-rc2","r7.0.12","r7.0.12-rc0","r7.0.12-rc1","r7.0.13","r7.0.13-rc0","r7.0.13-rc1","r7.0.14","r7.0.14-rc0","r7.0.15","r7.0.15-rc0","r7.0.15-rc1","r7.0.16","r7.0.16-rc0","r7.0.16-rc1","r7.0.2","r7.0.2-rc0","r7.0.2-rc1","r7.0.2-rc2","r7.0.3","r7.0.3-rc0","r7.0.3-rc1","r7.0.4","r7.0.4-rc0","r7.0.5","r7.0.5-rc0","r7.0.6","r7.0.6-rc0","r7.0.7","r7.0.7-rc0","r7.0.7-rc1","r7.0.7-rc2","r7.0.8","r7.0.8-rc0","r7.0.9","r7.0.9-rc0","r7.0.9-rc1","r8.0.0","r8.0.1","r8.0.1-rc0","r8.0.2","r8.0.3","r8.0.4","r8.0.4-rc0","r8.0.5-rc0","r8.0.5-rc1"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","digest":{"line_hashes":["128155175346927865578350885122545336633","216572293050139252382873165286309485744","317602093502445709217259093322985583291","323113763693778817951052644804516403756","204112331940165571227509339939775187128"],"threshold":0.9},"id":"CVE-2025-6709-00cf631b","target":{"file":"src/mongo/db/exec/sbe/stages/stages.h"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":11998,"function_hash":"324731960150289540980834762556588772295"},"id":"CVE-2025-6709-02da7f08","target":{"function":"ClassicStageBuilder::build","file":"src/mongo/db/query/classic_stage_builder.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":355,"function_hash":"74721346382742554427103070829589351717"},"id":"CVE-2025-6709-04aca510","target":{"function":"PlanEnumerator::getNext","file":"src/mongo/db/query/plan_enumerator.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":5055,"function_hash":"6750677528220597691009422494444808667"},"id":"CVE-2025-6709-0ca6dbf5","target":{"function":"QueryPlannerIXSelect::_compatible","file":"src/mongo/db/query/planner_ixselect.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["10066572042982452419190648275880004759","198010942107892612119844421222233465981","238555843601584275087869651267173119853","218292219009861977983067820021497983774"],"threshold":0.9},"id":"CVE-2025-6709-10d73161","target":{"file":"src/mongo/db/query/planner_ixselect.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["66747486518425923489000982985828416312","66965966368288672247966435120034690757","216452294733543330044469750897653841440","321073959764106855778235126773976578717","212982771766741900162197822039487310625","278079999784330475196550456161237500448","94858199688620481836041042337777616687","148807512214169000249497408166764724234","136451342793459111323744436382072994225","330133628046486975141314419369345094322","325658352348944307183031272830281185111","311618813173629078580658457448270110667","301936308844104445279166337006487839208"],"threshold":0.9},"id":"CVE-2025-6709-1b22917d","target":{"file":"src/mongo/unittest/death_test.cpp"},"source":"https://github.com/mongodb/mongo/commit/07391eabd130b66d493b22cf46cb258acd7f290f","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["242083792210778351481165114305958356400","285363800428779602818253050974640379640","66471680571458047424035600594659984993","177282653004432258403575052574659646224","153934457715871969266311620546393503793","324671449466228126784385113075657557331"],"threshold":0.9},"id":"CVE-2025-6709-2be19c53","target":{"file":"src/mongo/db/query/plan_yield_policy_sbe.h"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":197,"function_hash":"303474247503721939908789715347059158928"},"id":"CVE-2025-6709-2f2ed732","target":{"function":"PlanYieldPolicySBE::restoreState","file":"src/mongo/db/query/plan_yield_policy_sbe.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":559,"function_hash":"50499224752372844674575156741021451451"},"id":"CVE-2025-6709-30606578","target":{"function":"BatchedDeleteStage::_tryRestoreState","file":"src/mongo/db/exec/batched_delete_stage.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["323675016611822908901520286437579331970","134018369373461896889428775379890327204","110060140195004104665048901947222996114","49252125840708939910580577962037129759"],"threshold":0.9},"id":"CVE-2025-6709-320a26f6","target":{"file":"src/mongo/db/commands/getmore_cmd.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["74480530075972489207882079862334429764","76410312924971237751169851963874629808","79022626286008810693439777307702037688","63471234647693922887625181921846898126","213512571532026548196990037065560722984","216953702257803626192425694834763335091","184599858042867205163347561657227639026","334283130975759149651470692416758486813","143946319678917081822532102637446812885","238540202553349890141274583720274765758"],"threshold":0.9},"id":"CVE-2025-6709-34accfc1","target":{"file":"src/mongo/db/query/plan_executor_factory.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["325934018512381950537697277337436246001","182718589902973117584251429550925210539","7436171749258214253947874812145720868","116396899814353271616125903432356141976"],"threshold":0.9},"id":"CVE-2025-6709-3dfd0052","target":{"file":"src/mongo/db/commands/run_aggregate.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["55291228322113123472651093450521503599","180018901921691706908659934931964657311","26428813386726412500243738304337006991","66872429548502555232343484422131280617","27615411616634180615233341240025803872"],"threshold":0.9},"id":"CVE-2025-6709-437581b3","target":{"file":"src/mongo/bson/json.h"},"source":"https://github.com/mongodb/mongo/commit/07391eabd130b66d493b22cf46cb258acd7f290f","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["293531722908654728942905329556050041721","285363800428779602818253050974640379640","66471680571458047424035600594659984993","36457600927046150856866591000210935418","91167528583297184286392287030588200426","269738911857175080620016819736816540976"],"threshold":0.9},"id":"CVE-2025-6709-43ca9f42","target":{"file":"src/mongo/db/query/plan_yield_policy_impl.h"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":3655,"function_hash":"315579720131735595828496019705066544473"},"id":"CVE-2025-6709-450be5e7","target":{"function":"handleCursorCommand","file":"src/mongo/db/commands/run_aggregate.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["53195843026111884998938521343974374173","230237911581286265848288504352558145943","209305753029730154019924762943689408857","188278831708682375185310562172448117050"],"threshold":0.9},"id":"CVE-2025-6709-46b55b85","target":{"file":"src/mongo/db/query/classic_stage_builder.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["300794467364588470650714458349731930479","297547464734926693286926059429355668277","267722496984165982769356556964781668023","154974714873307532211197329326739040588","5094457713143674570103875040584755800","84759545642980302271699824215056548694","35910924543527921955524239539711328849"],"threshold":0.9},"id":"CVE-2025-6709-47a22a40","target":{"file":"src/mongo/db/query/plan_yield_policy_impl.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["117996222717711035934246435470014861681","134503435815170199102225179521540750073","186482670758146755212771325428210146174","175448674506301054507302686564081847271"],"threshold":0.9},"id":"CVE-2025-6709-5db5e3f0","target":{"file":"src/mongo/db/query/query_stats/query_stats.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["239760245189374196199053087318019641219","166658240041078105533858403956415681461","184613860848971087935595557361706193125","21627686114844893390008975237787558063","270299295809016924007056676644411041761","164457883294828323493140586031241570462","184613860848971087935595557361706193125","21627686114844893390008975237787558063"],"threshold":0.9},"id":"CVE-2025-6709-649dcc19","target":{"file":"src/mongo/db/query/expression_index.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":1499,"function_hash":"330353328274016122203123709077513116764"},"id":"CVE-2025-6709-73db0d9b","target":{"function":"makeIntervalsFromIndexBounds","file":"src/mongo/db/query/sbe_stage_builder_index_scan.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["250263281198017444821227733552288386246","198441432569712572956667618384930370071","295822432892057576868994036179268202438","231881901151763091665415253388419055314","241024755877053790139344843979215311631","225510159533409511924489908623956988591","177856668641505191942875708879728864925","107555778807491552857865182908244415150","167711042601681920367607688521685195883"],"threshold":0.9},"id":"CVE-2025-6709-76c9217d","target":{"file":"src/mongo/db/query/plan_yield_policy.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["9363958036791989920855153754359125296","212614258808394553218503732579496811630","324828096798884775161546544166307853114","311240997386380183087492118537665622982"],"threshold":0.9},"id":"CVE-2025-6709-7f149475","target":{"file":"src/mongo/db/query/plan_enumerator.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["277377213569911146800787737202021438332","53908694036135380776214055584401684745","252951334507202177988982079620970199983","109943819135770574535361211054042030073","101016684422344111112875123312037044903","274990836685198398734311682795086148904","65636733009629192353061126060144705329","271157300350561332144773959581690448684","275808718131174121238906172699728794279","43489190448824634502964281659554754095","299114111207886658383179497910085529337","321922192864572407019223826454262325999","77864546447380761012056365199274050029","243504318307872591819328232312274227556","146325652739038709420179137038080635757","5958108788073486123275839689309698606","324027511557631962734274590856477339458","49993491281180292530265995784764941194","3532795811511781073658114170344366526","46355575977180123017138011024333691311","143944725688219741959404666463409676181","315104558686313854661497816629956775504","8524865201194896361549724847407131696","247553640794788679706118738746146357103","278978346523894163995189087559252698162"],"threshold":0.9},"id":"CVE-2025-6709-82f141a0","target":{"file":"src/mongo/db/exec/batched_delete_stage.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":284,"function_hash":"103840727559771836177133984111106881023"},"id":"CVE-2025-6709-8771e688","target":{"function":"IndexScan::doRestoreStateRequiresIndex","file":"src/mongo/db/exec/index_scan.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["217222921185326005931509558903152731299","202666047583481052249424926852402174306","324964735073599379789922950373079220292","78630175158771248272312161803584528309","135454578156309532346709374605524967069","236400761571412401731360499454223294289","21276741565310543732628776997499044223","227019641067830197734788989019790544388","156936884464941145583647803903206686065","54491341209901364191025375712479702865"],"threshold":0.9},"id":"CVE-2025-6709-8b0a6ba2","target":{"file":"src/mongo/db/query/plan_executor_impl.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["133439807348065537311421421166547309690","164124192295490702291887422336681392804","281035850491657839420587571221341537258","90556418935779042526838498583952531267","273985468875539668411499917305436817747"],"threshold":0.9},"id":"CVE-2025-6709-94c9cc03","target":{"file":"src/mongo/db/exec/multi_plan.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["185111652293993979661524448227352044957","291102247367158132697069813398337419277","115768510144063777512212645370907164036","198731464680431393057645522227396959544","70058442634956184992006818573455857633","209424696169315984653035718560993404370"],"threshold":0.9},"id":"CVE-2025-6709-9a383323","target":{"file":"src/mongo/db/query/plan_yield_policy_sbe.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":242,"function_hash":"96544493495317899990589738151324423177"},"id":"CVE-2025-6709-9bd308b0","target":{"function":"MultiPlanStage::tryYield","file":"src/mongo/db/exec/multi_plan.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["205050424898769862710277687559331953608","108188596002158574450440502237856818599","21459500346659147619504989491625648974","23316749593539662910705972082917395804"],"threshold":0.9},"id":"CVE-2025-6709-9e183a45","target":{"file":"src/mongo/db/commands/distinct.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":8399,"function_hash":"271326683273544982550950067365164714652"},"id":"CVE-2025-6709-a5fa4151","target":{"function":"run","file":"src/mongo/db/commands/find_cmd.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":552,"function_hash":"18683832206106765511076032648809337438"},"id":"CVE-2025-6709-a791dd5f","target":{"function":"make","file":"src/mongo/db/query/plan_executor_factory.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["40446765967045617667202975806177330524","233077042914063112865669107989660618444","212623981943868464449046469850328780729","184174755363846185862649334084995489774","94533779795395835879465737500333911284"],"threshold":0.9},"id":"CVE-2025-6709-ae514af4","target":{"file":"src/mongo/db/exec/cached_plan.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["316812224940597349210802207153468412354","182540187870046299377185840611309772662","26235693254835517178998203862684720123","288365987673642931808837033988182548224","12634805768102346354597642259202202781","124963060713168580629168936788391930536","293631087943889812256072568006311929606","129313858920652648405295319762570784376","205723985492844250042200083227006731872","295305126718174767852394771211441977557","214372823518818284513240378260029913297","154839776255203802542823475742103318348","63966623324690558132458878876408542365","227886298463909455701668011020739809800","274719377545742581878851119981020161722","118018990569479107859615394364893193514","300711920207147043942293811610763238167","53728239849209811192533802918800223350","243132182210154584977178726137214177431","39369041185148501037962423918294899723","128474132530057300850619398133175026668","8186317940670349698100805971036852288","248484137817490873357539971574352476654","262181123974261924674842333426546494632","90278502623191581481154302716035029854"],"threshold":0.9},"id":"CVE-2025-6709-b49ba713","target":{"file":"src/mongo/bson/json.cpp"},"source":"https://github.com/mongodb/mongo/commit/07391eabd130b66d493b22cf46cb258acd7f290f","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":292,"function_hash":"212314662336198718601317664835626096162"},"id":"CVE-2025-6709-b581aedd","target":{"function":"PlanExecutorImpl::restoreState","file":"src/mongo/db/query/plan_executor_impl.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":626,"function_hash":"222574750477560596096716589933537609235"},"id":"CVE-2025-6709-b5a853d3","target":{"function":"fromjson","file":"src/mongo/bson/json.cpp"},"source":"https://github.com/mongodb/mongo/commit/07391eabd130b66d493b22cf46cb258acd7f290f","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":256,"function_hash":"33546882262172735446500270741996012865"},"id":"CVE-2025-6709-b8b715fe","target":{"function":"PlanYieldPolicyImpl::restoreState","file":"src/mongo/db/query/plan_yield_policy_impl.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":418,"function_hash":"127231367950262132446204453201931301605"},"id":"CVE-2025-6709-ba6bb206","target":{"function":"ExpressionMapping::S2CellIdsToIntervals","file":"src/mongo/db/query/expression_index.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":857,"function_hash":"136943759710338091808609219131235921288"},"id":"CVE-2025-6709-bec2528c","target":{"function":"waitForInserts","file":"src/mongo/db/query/plan_insert_listener.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":812,"function_hash":"198790066288247663210850446148914273963"},"id":"CVE-2025-6709-c0854628","target":{"function":"ExpressionMapping::S2CellIdsToIntervalsWithParents","file":"src/mongo/db/query/expression_index.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":1148,"function_hash":"165662390130461578036091815369857993057"},"id":"CVE-2025-6709-cde5bf4d","target":{"function":"BatchedDeleteStage::doWork","file":"src/mongo/db/exec/batched_delete_stage.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":1948,"function_hash":"47283986914761325475926390744079264293"},"id":"CVE-2025-6709-ce280be5","target":{"function":"DeathTestBase::Subprocess::monitorChild","file":"src/mongo/unittest/death_test.cpp"},"source":"https://github.com/mongodb/mongo/commit/07391eabd130b66d493b22cf46cb258acd7f290f","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["204878335947464531715224156725376504696","245647325101973811054468792992466554213","18167821231381065424203955202990452744","305132469608307041440322250996338723324","338344167953477306849321380176399901170","28970375424759521885513815498902567341","298945777755073561390381980673299560044","130774409745054099704797100497391746822","14835378616596713006524981070686067986","235823403628060078362789436373551558302","176107266499107545016942610312984524602","70812980394837969251164852922539057072","192040177631706200645779641736492572817","249131849034739123259348838676063306004","58536373459143504604540720926872541293","27680462529788255387394426092298453740"],"threshold":0.9},"id":"CVE-2025-6709-d01affce","target":{"file":"src/mongo/db/query/plan_insert_listener.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["310145841042637335541553791962897930236","311543557808608213145371239176229730064","175131045200136172532266146608020193559","256262569997707937423757943442022991823","317278975464925075008088702565401645868","319635852557297139785380027362212988687","95785691239032810479918336241160759786","142582924573948116995467094449666064603","11546348289710798252828873720639923130","319451271684589158221984003296669682815","119709092174357195225004179140296823920","19928889665998847499450170468114155132","95785691239032810479918336241160759786","142582924573948116995467094449666064603","11546348289710798252828873720639923130","174350732610990229124134651854190125986","78352110913453680275590408580146866864","53656193445160581702881541114181164748","151880895318421494993078559191889466808","199782988245736109274575865124553692469","11546348289710798252828873720639923130","41351663939500285380579369594871098794","152167945977488105890724328104801161993","78087364834970205680453819503004723218"],"threshold":0.9},"id":"CVE-2025-6709-d6133a8e","target":{"file":"src/mongo/db/query/mock_yield_policies.h"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["305366697272645678512491038926620382457","267277981781185756058943621693643061891","327333684406704850282880008980341516469","90672606295781307607942416164877328061"],"threshold":0.9},"id":"CVE-2025-6709-d8fdb3ce","target":{"file":"src/mongo/db/commands/find_cmd.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":1998,"function_hash":"7584353214389406896055162675308718886"},"id":"CVE-2025-6709-de645406","target":{"function":"generateBatch","file":"src/mongo/db/commands/getmore_cmd.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["326547268590213751697033750128594462304","84107794020022536153814592564297275335","268387525018530359938240450648917692496","301191309124457687501689138990266192784","150778458972771233999303548490005375655","260501911773537275670480528422877779479","171906715601209927970396339720359908980","107054036206056841934176796912731493015","62704519419826246455812321184968392284","303661548950509634286670656892005220053","333109777684795453467733616294019582832","331563329403508055055458396627964600706","234272602342529757114855898124866444406","218419791448674776985548290390992594474","294588867306508653416298605865421706262"],"threshold":0.9},"id":"CVE-2025-6709-df14f5cc","target":{"file":"src/mongo/db/exec/index_scan.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["66669881442852824787936729351307434629","252196052647726512801736103443139798194","43010886251990791615923373108652339192","295824361191604828986983024146208165700","314137545055407261048176757262993926301"],"threshold":0.9},"id":"CVE-2025-6709-e08dfae8","target":{"file":"src/mongo/db/exec/trial_stage.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["207116781706962205856707717630023094228","135169221765852504545383737733425835422","51443341853513551633927610171554928141","245965675408929541120275929136782993672","250754446376793506390399135194343105764"],"threshold":0.9},"id":"CVE-2025-6709-e46308c7","target":{"file":"src/mongo/db/query/sbe_stage_builder_index_scan.cpp"},"source":"https://github.com/mongodb/mongo/commit/f4184f18fe405b75258e85a8554481128fb46410","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":262,"function_hash":"219408669774578943757268511886527619001"},"id":"CVE-2025-6709-e5527d9c","target":{"function":"CachedPlanStage::tryYield","file":"src/mongo/db/exec/cached_plan.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":4046,"function_hash":"325083632210140472662197948349912913807"},"id":"CVE-2025-6709-f6a4ae22","target":{"function":"PlanExecutorImpl::_getNextImpl","file":"src/mongo/db/query/plan_executor_impl.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":89,"function_hash":"336468060843055155798902538574741651238"},"id":"CVE-2025-6709-f6d1e7e7","target":{"function":"fromjson","file":"src/mongo/bson/json.cpp"},"source":"https://github.com/mongodb/mongo/commit/07391eabd130b66d493b22cf46cb258acd7f290f","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":695,"function_hash":"17163711475758752371733642361163151245"},"id":"CVE-2025-6709-f869d006","target":{"function":"TrialStage::pickBestPlan","file":"src/mongo/db/exec/trial_stage.cpp"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["172095417943222793408459721845614832085","70593788930020327475897783536835079584","301622943424891820628680442764537420925","181396842072484409246561527125476597876","6348090669559122562424773930184817622","130467611979800834213016849972113247412","186159790561734539954936530103963169914","13288507047504718757208662166844864211","171207655008693202230385608044849013791","41614700961750625071935383364791091593","105405797283130893248166629237095155250","25872245783649697048866452370048587007","177340145804668669010774934650825551523","148910518141181997923082132789325636227","206059160285132481933036399671426944107","330504646280151007102773237821466780120","201293045937625516141358044488700227059"],"threshold":0.9},"id":"CVE-2025-6709-fb526179","target":{"file":"src/mongo/db/query/plan_yield_policy.h"},"source":"https://github.com/mongodb/mongo/commit/6951d91380daa05e54bb3cf02bd738c4be5b5673","signature_type":"Line","deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6709.json","vanir_signatures_modified":"2026-04-12T19:16:09Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}