CVE-2026-9737
HIGH
CVSS 7.1
mongodb_server
Verified Advisory
Query planner crash via $meta sort expression in MongoDB (CVE-2026-9737)
During query planning, MongoDB does not correctly handle the `$meta` expression when processing sort patterns in raw BSON object form. This leads to incorrect transformations that can trigger an invariant failure and crash the server, exploitable by any client able to issue a find command with a `$meta` sort expression.
Affected versions:
- 8.0.27
We recommend updating to: 8.2.12, 8.0.28, 7.0.39, 8.3.7.
CVSS 7.1 · our assessment: this_week
Reference: https://jira.mongodb.org/browse/SERVER-128341
Details: https://vuln.today/cve/CVE-2026-9737
Verified by vuln.today against published advisories.
Affected versions
- – 8.0.27
Fixed in: 8.2.12; 8.0.28; 7.0.39; 8.3.7
More advisories for mongodb_server
- CVE-2026-13066 – Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)
- CVE-2026-13065 – Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)
- CVE-2026-13064 – CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)
- CVE-2026-13060 – Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)
- CVE-2026-13055 – Authenticated denial of service via $_internalIndexKey in MongoDB (CVE-2026-13055)
- CVE-2026-13058 – Denial of service via missing transaction field validation in MongoDB (CVE-2026-13058)