EUVD-2026-56865
GHSA-7xvj-42gq-cx6p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege authentication required; scope unchanged; sole impact is complete availability loss of the server process, with no confidentiality or integrity effect.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.
AnalysisAI
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Technical ContextAI
MongoDB's time-series collections store measurements alongside a designated metaField used to group and partition data (e.g., sensor IDs, device names). The query execution engine applies predicates against these fields using specialized code paths distinct from regular collection handling. CWE-617 (Reachable Assertion) indicates the vulnerability manifests when an internal assertion - a runtime invariant check embedded in the server code - is violated by a specially constructed query predicate. Rather than returning an error to the client, the assertion failure triggers an unhandled abort, terminating the mongod process. The CPE cpe:2.3:a:mongodb:mongodb_server confirms this affects the MongoDB Server application itself, not a driver or connector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) indicates the path is network-reachable with low complexity, requiring only low-privilege authentication.
RemediationAI
The primary fix is to upgrade MongoDB Server to one of the following patched releases: 8.3.8, 8.0.29, or 7.0.40, as confirmed by the vendor and documented in https://jira.mongodb.org/browse/SERVER-129460. Administrators should identify which release branch they are on and apply the corresponding update. If immediate patching is not feasible, a targeted compensating control is to revoke write access to time-series collections for all non-administrative or untrusted users, since the vulnerability requires both authentication and write-level privileges against a time-series collection with a metaField. Note that revoking write access may impact legitimate application workflows that depend on ingesting time-series data, so assess data pipeline dependencies before applying this restriction. No other workarounds have been confirmed by the vendor.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today