EUVD-2026-56910
GHSA-wxp5-7rcf-9m3q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth or complexity required; impact is solely availability loss (mongos crash); scope unchanged as other systems are not directly compromised.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
AnalysisAI
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires that the target deployment uses a sharded MongoDB cluster with at least one mongos router process exposed on the network - standalone mongod instances and non-sharded replica sets are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the real-world risk profile: the attack is trivially automatable - no authentication, no complex preconditions, no user interaction - and the impact is reliable process termination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An external or internal attacker with network access to the mongos listener port constructs a malformed aggregation pipeline document designed to trigger the assertion failure in the aggregation framework. The attacker submits this command without authenticating, the mongos process hits the reachable assertion and aborts, severing all active client connections routed through it. … |
| Remediation | The primary remediation is to upgrade MongoDB Server to a patched version once released by MongoDB; however, no specific fix version is confirmed from available data - monitor the MongoDB release notes and the JIRA ticket at https://jira.mongodb.org/browse/SERVER-130110 for the target patch version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all MongoDB sharded cluster deployments and document mongos router locations and their client dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today