Which versions of MongoDB are affected by CVE-2026-9752?

MongoDB Server contains a denial-of-service vulnerability (CVE-2026-9752, CVSS 7.1) triggered by authenticated users executing specific geospatial queries, causing complete database process crashes.. A patch is available.

How to fix or mitigate CVE-2026-9752?

Within 24 hours: Audit MongoDB instances for active geospatial query usage and review authentication credentials with database access. Within 7 days: Implement network-level access controls to restrict who can connect to MongoDB; disable 2dsphere index-backed geospatial queries if not business-critical. Within 30 days: Monitor MongoDB security advisories for patch release; contact vendor for ETA on fix if timeline is critical to operations.

MongoDB CVE-2026-9752

Q: What is the CVSS score of CVE-2026-9752?

CVE-2026-9752 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35851 HIGH

NULL Pointer Dereference (CWE-476)

2026-06-09 mongodb

GHSA-wpr8-m35f-2w5c

Denial Of Service Null Pointer Dereference MongoDB Mongodb Server

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Updated

Jun 09, 2026 - 23:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 09, 2026 - 23:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 09, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Jun 09, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Jun 09, 2026 - 23:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 09, 2026 - 23:21 vuln.today

DescriptionCVE.org

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS.

Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.

AnalysisAI

Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial query backed by a 2dsphere index where the indexed field holds a GeoJSON GeometryCollection containing a Polygon defined with a strict-winding CRS. The flaw is a CWE-476 null pointer dereference reached because the rejection guard for unsupported strict-winding polygons does not recurse into GeometryCollection members. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.