MongoDB Server CVE-2026-96299

Requires a valid authenticated account with at least read-only privileges on the target database and the ability to run aggregation queries (find/aggregate with a $match stage). The attacker must nest internal schema-validation operators - meant only for server use but accepted in user-supplied query filters - and apply them to documents whose fields contain arrays, so that the evaluator expands every combination of array elements. Exploitation is limited by the authentication requirement (no anonymous/network-only path) and by the data shape: target documents must contain array fields for the combinatorial blow-up to occur. Impact is availability only - the crash of the mongod process - with no data disclosure or modification.

This is a genuine but moderate-priority availability issue, not a critical emergency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree cleanly: a network-reachable, low-complexity attack requiring an authenticated user with only read-only privileges, affecting availability alone (VA:H; confidentiality and integrity untouched). No EPSS score, KEV listing, or POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore self-inflicted or malicious-insider denial of service: any account that can run aggregation queries can crash the mongod process via memory exhaustion. There is no signal conflict between the CVSS vector and the description - both consistently describe authenticated, low-privilege, availability-only impact. The main uncertainty is deployment-specific: impact depends on whether the affected mongod shares a host with other critical services and on replica-set topology (a crashed primary triggers failover but restart loops are possible if the query is replayed). No EPSS data is available to gauge exploitation likelihood.

An authenticated user holding only read-only database access submits an aggregation query whose match filter nests internal schema-validation operators (normally reserved for server use) over fields containing arrays. The server attempts to evaluate every combination of array elements without a resource limit, driving mongod's memory usage up until the process is killed by the OS/OOM handler, taking the database node offline. No public exploit code is identified at time of analysis, but the attack is low-complexity and requires no user interaction once the attacker has read access.