EUVD-2026-35863
GHSA-43fh-5xpm-3q9m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.
AnalysisAI
Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting aggregation pipelines that combine the internal fromRouter:true flag with runtimeConstants.userRoles. No public exploit identified at time of analysis, but the bug is tracked in MongoDB's public JIRA (SERVER-123918), which makes the trigger conditions discoverable. Impact is limited to availability (VA:H) with no data exposure or integrity compromise.
Technical ContextAI
MongoDB Server is the document-database engine that executes the aggregation framework - a pipeline-based query language. The fromRouter:true field is an internal marker normally set by mongos routers when forwarding aggregations to shards, while runtimeConstants.userRoles is an internal context variable that injects the authenticated user's roles into the pipeline. CWE-617 (Reachable Assertion) indicates the server triggers a defensive assertion when these two internal-state inputs are presented together by a client, causing the mongod process to abort rather than handle the unexpected combination safely. The CPE indicates all versions of mongodb:mongodb_server are listed as affected pending advisory clarification.
RemediationAI
Upstream fix is tracked in MongoDB JIRA SERVER-123918 at https://jira.mongodb.org/browse/SERVER-123918; released patched version not independently confirmed from the supplied references, so consult the linked ticket and the MongoDB security advisories page for the exact build numbers per release train and upgrade affected mongod and mongos instances accordingly. As a compensating control until patched, audit and tighten role-based access so that application accounts only hold roles strictly required (avoid granting broad cluster-wide aggregation privileges to user-facing services), and restrict network reachability of mongod to trusted application tiers via firewall, VPC, or bindIp configuration - accepting that this only mitigates exposure from untrusted networks, not from compromised application credentials. Monitoring mongod for unexpected restarts and enabling crash-loop alerts will help detect attempted exploitation; there is no documented configuration toggle that disables fromRouter or runtimeConstants handling without breaking sharded query execution, so workarounds beyond access restriction are limited.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today