EUVD-2026-30777
GHSA-v7q4-vccc-3jxg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
AnalysisAI
Denial of service in MongoDB Server 7.0, 8.0, and 8.2 allows authenticated remote attackers to crash the database by inserting documents that trigger updates to a maliciously created '2dsphere_bucket' or 'queryable_encrypted_range' index on a non-timeseries bucket collection. The flaw stems from a reachable assertion (CWE-617) and is reported by MongoDB itself with a vendor patch available; no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lives in MongoDB Server's index creation logic, where specialty index types intended for specific collection structures ('2dsphere_bucket' for timeseries bucket collections and 'queryable_encrypted_range' for Queryable Encryption) can be created on incompatible non-timeseries bucket collections without proper validation. CWE-617 (Reachable Assertion) indicates the server reaches an internal sanity check that should never fire under valid operation, then aborts the entire mongod process when a subsequent document insert forces the index to update. The CPE entry cpe:2.3:a:mongodb,_inc.:mongodb_server confirms the server daemon itself is the affected component, not drivers or client tooling.
RemediationAI
Vendor-released patch: upgrade MongoDB Server to 7.0.32, 8.0.21, or 8.2.6 (or any later release on the same train), as specified by MongoDB in SERVER-116327 (https://jira.mongodb.org/browse/SERVER-116327). Until the upgrade window, restrict the createIndex privilege to trusted administrative roles only - revoke it from application service accounts that do not legitimately need to create indexes at runtime - which prevents the specific trigger but breaks any application that performs ensureIndex on startup. As a narrower compensating control, audit and block creation of '2dsphere_bucket' and 'queryable_encrypted_range' index types on non-timeseries, non-queryable-encrypted collections via an auditing/proxy layer, accepting that this requires custom tooling since MongoDB has no native index-type allowlist.
More in Mongodb Server
View allAuthorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthentic
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network acc
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by trigger
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today