EUVD-2026-56904
GHSA-rf6p-955q-5j7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via standard MongoDB port, low-privilege auth required, no interaction needed; high availability loss from crash, low confidentiality from bounded memory leak, no integrity impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.
AnalysisAI
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
CWE-125 (Out-of-bounds Read) identifies the root cause as insufficient bounds validation when processing attacker-controlled numeric input inside MongoDB's aggregation pipeline engine. MongoDB's aggregation framework processes multi-stage query pipelines involving arithmetic, type coercion, date math, and string operations - any of which may perform low-level memory reads indexed by numeric parameters. If a specific pipeline stage fails to validate an input value before using it as a memory offset or length, the server can read beyond the allocated buffer boundary, causing either a segmentation fault (crash) or exposure of adjacent in-process memory. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* uses a wildcard version, indicating the reporter has not yet narrowed the affected range to specific releases. The Jira ticket SERVER-129617 is the primary upstream tracking reference.
RemediationAI
A specific patched version is not confirmed in the available data - operators should monitor https://jira.mongodb.org/browse/SERVER-129617 and MongoDB's official release notes for a targeted fix version before upgrading. Until a patch is released and confirmed, the most effective compensating control is restricting aggregation pipeline execution to highly trusted accounts only by auditing and tightening MongoDB RBAC roles - revoking aggregation-capable permissions from any account that does not strictly require them reduces the attacker pool, though this may break application functionality for read-heavy workloads. Ensuring MongoDB is not directly reachable from untrusted networks (e.g., enforcing VPN or private subnet placement) reduces exposure but does not mitigate risk from internal or compromised authenticated accounts. Application-layer input validation of numeric parameters before they reach MongoDB aggregation calls is an additional defense-in-depth measure, at the cost of added application complexity and incomplete coverage of all pipeline stages.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today