EUVD-2026-28326
GHSA-v547-m6pg-pf7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.
When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server.
This issue affects MongoDB Server 8.2 versions prior to 8.2.7.
AnalysisAI
MongoDB Server 8.2 before version 8.2.7 crashes when an authenticated user supplies an empty pipeline to $rankFusion or $scoreFusion aggregation operators on a view. The server fails to validate that the pipeline array is non-empty before accessing its first element during view resolution, resulting in a null pointer dereference that terminates the mongod process. This denial-of-service condition requires database authentication but can be triggered remotely via aggregation queries.
Technical ContextAI
MongoDB's view resolution mechanism inspects aggregation pipelines to detect Atlas Search stages at the beginning of the pipeline. The vulnerable code in the $rankFusion and $scoreFusion stage handlers directly accesses the first element of an input pipeline array (typically via array indexing or pointer dereference) without first checking if the array is non-empty. This is a classic null pointer dereference vulnerability (CWE-476). When a view's aggregation pipeline is empty, the unvalidated array access reads from a null pointer, causing the mongod process to crash. The vulnerability exists in the aggregation pipeline execution layer responsible for resolving views in MongoDB 8.2.x releases.
RemediationAI
Upgrade MongoDB Server to version 8.2.7 or later. This is the vendor-released patch that fixes the null pointer dereference in the $rankFusion and $scoreFusion stage handlers. If immediate upgrade is not feasible, implement network-level access controls to restrict database authentication to trusted application servers and internal administrative users only. Additionally, monitor for aggregation queries using $rankFusion or $scoreFusion operators and alert on empty pipeline parameters as a detective control. Disable or restrict the use of views with $rankFusion and $scoreFusion operators until patching is complete if those features are not critical to operations. Consult MongoDB advisory SERVER-121851 for additional context and rollout timelines.
More in Mongodb Server
View allAuthorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthentic
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network acc
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by trigger
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today