EUVD-2026-35865
GHSA-ppxc-fr36-g8v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.
AnalysisAI
Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pipelines that use the internal $exchange stage with key-range partitioning and order-preserving delivery. When a single key range fills its consumer buffer, the high watermark is not updated correctly, leading to a reachable assertion (CWE-617) and likely process termination. No public exploit identified at time of analysis.
Technical ContextAI
MongoDB's aggregation framework includes an internal $exchange stage used to parallelize pipeline execution across multiple consumers, with options for key-range partitioning and order-preserving delivery. Each consumer has its own buffer, and a 'high watermark' tracks how much data each key range has produced to coordinate flow control. The root cause class is CWE-617 (Reachable Assertion): a code path exists where the server detects a full per-consumer buffer but fails to update the watermark as intended, leaving an internal invariant violated. The affected product per CPE is cpe:2.3:a:mongodb:mongodb_server, with the specific version range left as a wildcard in the available data.
RemediationAI
No vendor-released patch version is identified at time of analysis in the provided data; consult the MongoDB tracker at https://jira.mongodb.org/browse/SERVER-124031 for the fix version and upgrade once a patched release is published by MongoDB. As compensating controls while patching, restrict aggregation pipeline execution rights so only trusted application service accounts hold roles that permit arbitrary $exchange-bearing pipelines (revoke or scope down roles granting find/aggregate on sensitive databases for ad-hoc users), and front MongoDB with a query proxy or application layer that rejects pipelines using the internal $exchange stage - the trade-off is potential breakage of any internal tooling that legitimately invokes $exchange, so test query patterns first. Network-level controls (binding MongoDB to private subnets, enforcing TLS and SCRAM/x.509 auth, and limiting client IPs via firewall) further reduce the pool of accounts able to reach the vulnerable code path, with the side effect of needing to maintain an allowlist.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-617 – Reachable Assertion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today