EUVD-2026-56880
GHSA-q3g2-c227-xmvh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the text index prerequisite as a condition beyond attacker control; PR:L captures the required read authentication; no confidentiality or integrity impact applies.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.
AnalysisAI
MongoDB Server's query planner contains a null pointer dereference (CWE-476) that enables any authenticated user holding read-level privileges to crash the server process by submitting a specially crafted query against a collection with a text index. Affected branches span MongoDB 7.0.x, 8.0.x, and 8.3.x, with fixed releases available in 7.0.40, 8.0.29, and 8.3.8 respectively. No public exploit or active exploitation is identified; SSVC rates exploitation as none and the attack is not automatable, though the availability impact is total for the targeted server instance.
Technical ContextAI
The vulnerability originates in MongoDB Server's internal query planner, the subsystem responsible for parsing, optimizing, and dispatching query execution plans. CWE-476 (Null Pointer Dereference) indicates that when the planner processes a malformed query submitted against a collection that carries a text index, it follows a code path that dereferences a null pointer - causing an unhandled fault and terminating the mongod process. Text indexes in MongoDB are purpose-built structures for full-text search; they involve a distinct query processing pipeline that appears to contain an unguarded pointer dereference in this path. The affected CPE is cpe:2.3:a:mongodb:mongodb_server covering the 7.0, 8.0, and 8.3 version branches. MongoDB Jira issue SERVER-130266 is the upstream tracking reference.
RemediationAI
Upgrade MongoDB Server to the patched release corresponding to your deployed branch: 8.3.8, 8.0.29, or 7.0.40, all of which are confirmed available from MongoDB per the vendor advisory and Jira ticket https://jira.mongodb.org/browse/SERVER-130266. If an immediate upgrade cannot be performed, the most targeted compensating control is to audit and temporarily drop text indexes on collections accessible to low-privilege or untrusted users using db.collection.dropIndex() - this eliminates the required precondition for exploitation but disables full-text search on those collections until reinstated post-patch. An alternative is to tighten access controls so that only fully trusted application accounts hold read privileges on text-indexed collections, reducing the risk surface without disrupting search functionality, though this does not eliminate the vulnerability. No other workarounds have been confirmed by the vendor.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today