EUVD-2026-56909
GHSA-4f9m-g9cm-wxq9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated write access to timeseries collections (PR:L); no scope change as impact is confined to the MongoDB server process; high availability from crash, low C/I from limited memory exposure and corruption.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.
AnalysisAI
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated MongoDB session - the CVSS PR:L metric confirms at least low-privilege credentials are required; unauthenticated exploitation is not possible; (2) write privileges specifically to one or more timeseries collections - standard read-only or non-timeseries write access is insufficient; (3) the target instance must have at least one timeseries collection created, as the flaw is specific to that collection type; (4) the attacker must execute a two-phase insertion sequence - first corrupting the bucket structure, then inserting into the same corrupted bucket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H) presents a clear risk profile: network-reachable, low complexity, no attack requirements, but gated behind PR:L - requiring authenticated write access to a timeseries collection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid MongoDB account holding write access to a timeseries collection - such as a compromised application credential or an insider - inserts a sequence of specially crafted documents designed to drive the internal bucket data structure into an inconsistent state. A follow-on insert into the same affected bucket then triggers the server process to access memory outside its intended bounds, causing either a crash that takes the database offline (denial of service) or a memory-disclosure condition leaking in-process data. … |
| Remediation | No vendor-released patch version has been identified in the available data - the sole reference is the internal MongoDB Jira ticket SERVER-129994, which has not surfaced a confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your MongoDB deployment to identify instances using timeseries collections and verify current authentication configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today