EUVD-2026-35865
GHSA-ppxc-fr36-g8v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
Lifecycle Timeline
8DescriptionCVE.org
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.
AnalysisAI
Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pipelines that use the internal $exchange stage with key-range partitioning and order-preserving delivery. When a single key range fills its consumer buffer, the high watermark is not updated correctly, leading to a reachable assertion (CWE-617) and likely process termination. No public exploit identified at time of analysis.
Technical ContextAI
MongoDB's aggregation framework includes an internal $exchange stage used to parallelize pipeline execution across multiple consumers, with options for key-range partitioning and order-preserving delivery. Each consumer has its own buffer, and a 'high watermark' tracks how much data each key range has produced to coordinate flow control. The root cause class is CWE-617 (Reachable Assertion): a code path exists where the server detects a full per-consumer buffer but fails to update the watermark as intended, leaving an internal invariant violated. The affected product per CPE is cpe:2.3:a:mongodb:mongodb_server, with the specific version range left as a wildcard in the available data.
RemediationAI
No vendor-released patch version is identified at time of analysis in the provided data; consult the MongoDB tracker at https://jira.mongodb.org/browse/SERVER-124031 for the fix version and upgrade once a patched release is published by MongoDB. As compensating controls while patching, restrict aggregation pipeline execution rights so only trusted application service accounts hold roles that permit arbitrary $exchange-bearing pipelines (revoke or scope down roles granting find/aggregate on sensitive databases for ad-hoc users), and front MongoDB with a query proxy or application layer that rejects pipelines using the internal $exchange stage - the trade-off is potential breakage of any internal tooling that legitimately invokes $exchange, so test query patterns first. Network-level controls (binding MongoDB to private subnets, enforcing TLS and SCRAM/x.509 auth, and limiting client IPs via firewall) further reduce the pool of accounts able to reach the vulnerable code path, with the side effect of needing to maintain an allowlist.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-617 – Reachable Assertion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today