EUVD-2026-35861
GHSA-cmc7-vq67-x4pm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
Lifecycle Timeline
7DescriptionCVE.org
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.
AnalysisAI
Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the server process by issuing a specially crafted aggregation followed by a getMore command on the same cursor, triggering a null pointer dereference in the aggregation stage's _subPipeline field. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a credible availability threat for multi-tenant or shared MongoDB deployments.
Technical ContextAI
The affected component is MongoDB Server's aggregation framework, identified by CPE cpe:2.3:a:mongodb:mongodb_server. The aggregation pipeline subsystem supports nested sub-pipelines (used by stages like $lookup, $unionWith, and $facet) that maintain state across cursor batches. During processing of certain pipelines, an aggregation stage can leave its internal _subPipeline pointer null. When the client issues a subsequent getMore on the same cursor - the standard mechanism for fetching additional result batches - the server reattaches the operation context and dereferences this null pointer. This is a classic CWE-476 (NULL Pointer Dereference) bug rooted in state-management between cursor lifecycle phases (initial aggregate vs. continuation via getMore), and it crashes the mongod process rather than corrupting memory or exposing data.
RemediationAI
Patch available per vendor advisory - consult MongoDB SERVER-123688 at https://jira.mongodb.org/browse/SERVER-123688 for the exact 8.0.x fixed build and upgrade to that release. As a compensating control until patched, restrict the aggregation privilege by removing the 'read' and broader data-reading roles from untrusted accounts and granting only narrowly scoped find privileges (trade-off: legitimate analytics and $lookup-based queries from those accounts will fail). Operators can also place mongod behind a connection-level proxy or firewall that limits which application identities can reach the database, and enable rapid auto-restart via systemd or the orchestrator (trade-off: hides repeated crashes that may mask an ongoing attack, so pair with alerting on mongod restart events). Auditing aggregation usage via the database profiler can help identify the malicious pipeline pattern post-incident.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today