EUVD-2026-35866
GHSA-qh22-j9ch-4x4c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.
AnalysisAI
MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash the mongod process or obtain incorrect query results by inserting specially crafted documents. The root cause - insufficient separation between user-controlled document fields and internal execution metadata (CWE-617: Reachable Assertion) - means the attack surface is the normal document write workflow, requiring no elevated roles. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with this profile: network-reachable, low complexity, low-privilege; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
MongoDB Server is a document-oriented NoSQL database that stores and queries BSON (Binary JSON) documents. During query execution, the server maintains internal metadata structures - such as query plan cache entries, execution stage descriptors, and field path trackers - that are separate from user data. CWE-617 (Reachable Assertion) indicates that crafted document field names or structures can reach a code path that contains an internal assertion or invariant check, triggering an unhandled assertion failure that causes the mongod process to terminate or produce corrupted intermediate results. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* uses a full wildcard version range, meaning the NVD has not yet bounded the affected version scope to specific releases. The referenced JIRA ticket SERVER-123633 (https://jira.mongodb.org/browse/SERVER-123633) is the canonical upstream tracking issue and likely contains patch commit or fix-version information not yet reflected in public metadata.
RemediationAI
No vendor-released patch version has been confirmed from available data - the sole reference is the MongoDB JIRA ticket SERVER-123633 at https://jira.mongodb.org/browse/SERVER-123633, which should be monitored for a fix-version announcement. Until a patch is available, restrict document INSERT and CREATE privileges to only explicitly trusted application service accounts; removing write access from broadly-scoped or shared credentials directly eliminates the ability to deliver the malicious document payload, though this may require application-level refactoring. Enforce strict server-side schema validation rules (using MongoDB's built-in JSON Schema validator) to reject documents with unexpected or suspicious field naming patterns before they reach the vulnerable execution paths - note this adds query latency on write operations. Monitor mongod process logs for unexpected assertion failures or crashes (SIGABRT, invariant violations) as indicators of exploitation attempts. Subscribe to MongoDB security advisories at https://www.mongodb.com/alerts to receive notification when a patched release is published.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today