EUVD-2026-47791Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A matches adjacent-network requirement from CVSS 4.0; AC:H maps the AT:P preconditions (trusted CA cert or MITM capability); pure availability impact with no scope change.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.
AnalysisAI
MongoDB Server terminates abnormally during outbound TLS handshake when a remote peer delivers a malformed OCSP response, producing a denial-of-service condition against the database process itself. OCSP stapling validation is enabled by default for all outgoing TLS connections, meaning no operator misconfiguration is required to expose this attack surface - any MongoDB server initiating TLS connections is potentially reachable. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the default-enabled feature combined with the adjacent-network attack vector makes this a credible operational risk for MongoDB clusters traversing partially trusted or shared network segments.
Technical ContextAI
MongoDB Server performs OCSP (Online Certificate Status Protocol) stapling validation by default when initiating outbound TLS connections. OCSP allows a TLS peer to bundle a pre-fetched certificate revocation response during the handshake, avoiding a separate round-trip to the CA's OCSP responder. A NULL pointer dereference (CWE-476) occurs in MongoDB's OCSP response parsing logic when the bundled response is malformed - the parser likely fails to validate a mandatory field or length boundary before dereferencing a pointer, causing an unhandled crash. The CVSS 4.0 vector assigns AV:A (adjacent network), indicating the attacker must share a network segment with or have routing adjacency to the MongoDB node; AT:P (attack requirements: present) acknowledges the specific preconditions around CA trust or network position. No CPE strings or explicit affected version ranges were included in the available intelligence, limiting precision on the software scope.
RemediationAI
No vendor-released patch version has been confirmed from available data - the only reference is an internal MongoDB Jira ticket (SERVER-128362) with no public fix version disclosed. Administrators should monitor MongoDB's official release notes and SERVER-128362 for a patched release announcement. As an interim compensating control, OCSP stapling validation for outgoing TLS connections can be disabled via MongoDB's TLS configuration parameters (consult MongoDB documentation for the relevant tlsAllowInvalidCertificates or OCSP-specific flags for your version); note that disabling OCSP stapling removes the attack surface entirely but also disables certificate revocation checking - this trade-off must be weighed against the organization's PKI compliance requirements. Restricting MongoDB outbound TLS connections to fully trusted, internally controlled network paths eliminates the untrusted-network-path exploitation scenario. Tightly controlling which hosts receive certificates from the cluster's trusted CA reduces the trusted-peer exploitation scenario. Network segmentation that prevents adjacency from untrusted hosts further limits the AV:A attack surface.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today