EUVD-2026-47796Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query engine (AV:N), simple crafted pipeline (AC:L), requires a read-only authenticated account (PR:L), no interaction, and only availability impact from the mongod crash (A:H, C/I:N).
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.
AnalysisAI
Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Technical ContextAI
The vulnerability lives in MongoDB's aggregation framework, specifically the $linearFill window-function operator used inside $setWindowFields for gap-filling numeric series. $linearFill relies on a sortBy specification to order documents before interpolation. Per CWE-476 (NULL Pointer Dereference), the execution engine fails to fully validate the type of the sortBy expression before dereferencing it, so a sortBy of an unexpected type leads to a null dereference and abnormal termination of mongod. The flaw is in query execution rather than parsing/authorization, which is why a read-only role - normally considered safe - is sufficient to reach the vulnerable code path.
RemediationAI
No vendor-released patched version was identified in the available data; the fix is tracked in MongoDB's issue tracker at https://jira.mongodb.org/browse/SERVER-127280, which should be monitored for the exact patched release train (Community and Enterprise), and the upgrade applied once published. Until a patched build is deployed, reduce exposure by tightening role-based access control so that untrusted or broadly-shared accounts do not hold even read privileges on affected clusters, since read access is the only prerequisite; where feasible, restrict network reachability of mongod to trusted application hosts only, and monitor mongod for abnormal termination and automatic-restart loops to detect exploitation. These compensating controls limit who can submit the crafted pipeline but do not remove the underlying flaw, and RBAC tightening may disrupt legitimate read consumers, so validate access needs before restricting them.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today