EUVD-2026-56912
GHSA-m7wq-2pg8-h638
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects mandatory authenticated read access; A:H captures complete server process termination; S:U and C:N/I:N because crash is self-contained with no data exposure.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
AnalysisAI
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid MongoDB credentials with at minimum read privileges on any database accessible on the target server - unauthenticated attackers cannot trigger this flaw, as confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) characterizes this as network-reachable, low-complexity exploitation by any authenticated low-privileged user with no additional prerequisites - a realistic threat in any multi-user or application-connected MongoDB deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid MongoDB read-level credentials - through phishing, credential stuffing against an exposed endpoint, or a compromised application service account - connects to the MongoDB server over the network and submits a specially crafted query filter containing type-mismatched BSON values designed to trigger the type confusion in the query subsystem. The server process crashes immediately upon evaluating the malformed filter, causing a complete database outage. … |
| Remediation | No vendor-released patched version has been confirmed in the available data at time of analysis; the fix status should be monitored via MongoDB JIRA ticket SERVER-130111 at https://jira.mongodb.org/browse/SERVER-130111. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MongoDB Server instances in your environment and their current versions, then immediately restrict database user privileges to limit read access to only essential service accounts and roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today