Skip to main content

MongoDB Server CVE-2026-9740

| EUVDEUVD-2026-35857 HIGH
Uncontrolled Recursion (CWE-674)
2026-06-09 mongodb GHSA-wvrr-4w4f-3v54
Denial Of Service Mongodb Server
8.7
CVSS 4.0 · Vendor: mongodb
Share

Severity by source

Vendor (mongodb) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Jun 10, 2026 - 02:01 EUVD
Analysis Updated
Jun 09, 2026 - 23:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 09, 2026 - 23:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 09, 2026 - 23:22 vuln.today
cvss_changed
CVSS changed
Jun 09, 2026 - 23:22 NVD
7.5 (HIGH) 8.7 (HIGH)
Analysis Generated
Jun 09, 2026 - 23:21 vuln.today

DescriptionCVE.org

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

AnalysisAI

Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed mongod port
Delivery
Open TCP connection to wire protocol
Exploit
Send crafted BSON with nested binary
Execution
Trigger mutual recursion in validator
Persist
Exhaust process stack
Impact
Crash mongod and deny service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of MongoDB Server is possible because the vulnerable BSON validation runs on any incoming wire-protocol message before authentication is enforced (CVSS AV:N/AC:L/AT:N/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signal alignment is strong: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates network-reachable, low-complexity, no-auth, no-user-interaction exploitation, and VA:H confirms high availability impact (matching the crash described). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the network identifies an exposed mongod port (commonly 27017), opens a TCP connection, and sends a single crafted wire-protocol message containing a BSON document with nested binary subtype structures designed to trigger the mutual recursion in the validator. The validator's depth tracking resets on each re-entry, the stack is exhausted, and mongod terminates, taking the database (and any application depending on it) offline; the attacker can repeat the message after restart to maintain the outage. …
Remediation Patch available per vendor advisory - upgrade mongod to the patched point release of your major version line as documented in MongoDB JIRA SERVER-125063 (https://jira.mongodb.org/browse/SERVER-125063); exact fix versions are not enumerated in the supplied data, so confirm the target build against the ticket before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify and inventory all MongoDB Server instances, document versions and deployment locations (internal vs. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mongodb Server

View all
CVE-2026-8053 HIGH
8.7 May 12

Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
CVE-2026-4148 HIGH
8.7 Mar 17

MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
CVE-2026-9742 HIGH
8.2 Jun 09

Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
CVE-2026-8336 HIGH
7.7 May 13

Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
CVE-2026-9753 HIGH
7.2 Jun 09

Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
CVE-2026-9750 HIGH
7.1 Jun 09

MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash t
CVE-2026-9748 HIGH
7.1 Jun 09

Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an agg
CVE-2026-9752 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial q
CVE-2026-9743 HIGH
7.1 Jun 09

Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the ser
CVE-2026-9749 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pi
CVE-2026-9747 HIGH
7.1 Jun 09

Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting ag
CVE-2026-9746 HIGH
7.1 Jun 09

Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2025-9624 HIGH POC
8.3
CVE-2025-57809 HIGH POC
7.7
CVE-2026-54297 HIGH POC
7.5
CVE-2025-1752 HIGH POC
7.5
CVE-2025-71382 HIGH POC
7.1
CVE-2026-42039 MEDIUM POC
6.9
CVE-2025-46206 MEDIUM POC
6.5
CVE-2025-65519 MEDIUM POC
6.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Share

CVE-2026-9740 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy