EUVD-2026-35861
GHSA-cmc7-vq67-x4pm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.
AnalysisAI
Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the server process by issuing a specially crafted aggregation followed by a getMore command on the same cursor, triggering a null pointer dereference in the aggregation stage's _subPipeline field. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a credible availability threat for multi-tenant or shared MongoDB deployments.
Technical ContextAI
The affected component is MongoDB Server's aggregation framework, identified by CPE cpe:2.3:a:mongodb:mongodb_server. The aggregation pipeline subsystem supports nested sub-pipelines (used by stages like $lookup, $unionWith, and $facet) that maintain state across cursor batches. During processing of certain pipelines, an aggregation stage can leave its internal _subPipeline pointer null. When the client issues a subsequent getMore on the same cursor - the standard mechanism for fetching additional result batches - the server reattaches the operation context and dereferences this null pointer. This is a classic CWE-476 (NULL Pointer Dereference) bug rooted in state-management between cursor lifecycle phases (initial aggregate vs. continuation via getMore), and it crashes the mongod process rather than corrupting memory or exposing data.
RemediationAI
Patch available per vendor advisory - consult MongoDB SERVER-123688 at https://jira.mongodb.org/browse/SERVER-123688 for the exact 8.0.x fixed build and upgrade to that release. As a compensating control until patched, restrict the aggregation privilege by removing the 'read' and broader data-reading roles from untrusted accounts and granting only narrowly scoped find privileges (trade-off: legitimate analytics and $lookup-based queries from those accounts will fail). Operators can also place mongod behind a connection-level proxy or firewall that limits which application identities can reach the database, and enable rapid auto-restart via systemd or the orchestrator (trade-off: hides repeated crashes that may mask an ongoing attack, so pair with alerting on mongod restart events). Auditing aggregation usage via the database profiler can help identify the malicious pipeline pattern post-incident.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today