MongoDB
Monthly
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Direct storage-engine writes to arbitrary internal MongoDB tables are possible through an authorization bypass in the applyOps command affecting MongoDB Server 8.3.0 through 8.3.8. An authenticated user holding elevated internal MongoDB privileges can specify a client-inaccessible internal replication mode value, circumventing a disabled production feature gate and enabling container operations that are suppressed by default. Because the authorization check validates only the operation's namespace rather than the actual storage engine target, the attacker can route writes to unrelated internal metadata or other collections' data, potentially corrupting database state. No public exploit has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when configured with a CA file, silently accepting connections from clients that present no certificate at all. Deployments that rely on client certificate authentication as the sole means of identifying users are fully exposed - any remote party with network access to the listener can establish a session and read all MongoDB data surfaced through the SQL interface. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-privilege nature of the flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is bounded by a specific non-default configuration prerequisite.
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.
Atlas Vector Search in MongoDB Server exposes a horizontal authorization bypass allowing an authenticated low-privileged user to read documents from a view they are not authorized to access, crossing view-level access control boundaries within the same underlying collection. The flaw arises from MongoDB Server insufficiently validating user-supplied fields before forwarding internal requests to the search process, enabling the search backend to return documents outside the scope of the caller's authorized view. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.
Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Denial of service in MongoDB allows an authenticated attacker to exhaust server CPU by submitting query operations that use deeply nested $jsonSchema validation constructs, producing a runaway CPU-bound operation that cannot be halted via standard administrative controls such as killOp. Reported by MongoDB's own CNA (SERVER-125872) and classified as inefficient algorithmic complexity (CWE-407), with no public exploit identified at time of analysis. The inability to interrupt the operation elevates this above a routine resource-consumption bug because normal recovery tooling is ineffective.
Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in MongoDB Server allows an authenticated user holding limited read privileges to read documents from collections they are not permitted to access, exploiting a discrepancy between how the $graphLookup aggregation stage is authorized versus how it is executed when the target collection is referenced inside an existing view's pipeline definition. The flaw (CWE-863, Incorrect Authorization) yields cross-collection data disclosure with no integrity or availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV; it was self-reported by MongoDB's CNA and tracked in SERVER-127357.
Authorization bypass in MongoDB Server allows an authenticated low-privileged user to read and write documents that should be shielded by role-based, query-level access controls. Because the server insufficiently validates certain client-supplied command parameters, crafted find, update, delete, and aggregate commands can sidestep the access boundaries enforced for a user's role. The flaw only manifests in non-apiStrict deployments (the default), and per the vendor CVSS 4.0 vector it yields high confidentiality and integrity impact; no public exploit has been identified at time of analysis.
Denial of service in MongoDB Server (mongod) allows an authenticated user holding only basic write privileges to crash the database process by submitting a crafted transaction command that omits some required fields. The inconsistent validation of related transaction parameters trips a fatal internal invariant (CWE-617), aborting mongod and interrupting availability for all clients. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; impact is limited to availability, with no data disclosure or integrity effect.
Denial of service in MongoDB Server allows an authenticated database user to submit an aggregation/query expression that generates very large arrays, forcing the server to allocate oversized intermediate objects in memory and crash with an out-of-memory (OOM) error. Reported by MongoDB's own CNA and tracked in SERVER-124355, the flaw carries a CVSS 4.0 base score of 7.1 with an availability-only impact (VA:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) lets any authenticated user with aggregation-pipeline privileges crash the database process by invoking the internal `$_internalIndexKey` aggregation expression against a compound wildcard index. The expression fails to handle compound wildcard index specifications, tripping an internal consistency check (assertion) that aborts the server. No public exploit identified at time of analysis, and the flaw is reported by MongoDB's own CNA as a Denial of Service issue with no confidentiality or integrity impact.
Memory disclosure and denial of service in MongoDB Server's server-side JavaScript engine allow an authenticated user with read privileges and JavaScript execution rights to read freed heap memory or crash the mongod process. The flaw is triggered during BSON-to-JavaScript array conversion when operators such as $where or $function are evaluated. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by MongoDB.
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. No public exploit identified at time of analysis, but the low-complexity, no-auth profile makes this a priority patch for internet-reachable MongoDB deployments.
Information disclosure in MongoDB Server allows authenticated users holding the read role to obtain small amounts of uninitialized stack memory by submitting specially-crafted filemd5 commands. The flaw stems from CWE-457 (Use of Uninitialized Variable) in the filemd5 command handler, and while no public exploit has been identified at time of analysis, the low attack complexity and network reachability make it a credible insider/credential-theft risk against MongoDB databases.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial query backed by a 2dsphere index where the indexed field holds a GeoJSON GeometryCollection containing a Polygon defined with a strict-winding CRS. The flaw is a CWE-476 null pointer dereference reached because the rejection guard for unsupported strict-winding polygons does not recurse into GeometryCollection members. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash the mongod process or obtain incorrect query results by inserting specially crafted documents. The root cause - insufficient separation between user-controlled document fields and internal execution metadata (CWE-617: Reachable Assertion) - means the attack surface is the normal document write workflow, requiring no elevated roles. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with this profile: network-reachable, low complexity, low-privilege; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pipelines that use the internal $exchange stage with key-range partitioning and order-preserving delivery. When a single key range fills its consumer buffer, the high watermark is not updated correctly, leading to a reachable assertion (CWE-617) and likely process termination. No public exploit identified at time of analysis.
Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an aggregation pipeline that places the $_internalConvertBucketIndexStats stage upstream of a $facet stage. The misuse of the internal PauseExecution signal trips a hard invariant assertion in TeeBuffer, terminating the database process. No public exploit identified at time of analysis, and the issue is tracked in MongoDB's internal tracker SERVER-123951.
Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting aggregation pipelines that combine the internal fromRouter:true flag with runtimeConstants.userRoles. No public exploit identified at time of analysis, but the bug is tracked in MongoDB's public JIRA (SERVER-123918), which makes the trigger conditions discoverable. Impact is limited to availability (VA:H) with no data exposure or integrity compromise.
Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with the internal $_requestReshardingResumeToken option and the exchange option, triggering a reachable invariant that crashes the mongod process. Any logged-in user with low privileges can repeatedly invoke the crash on default deployments, producing service-wide downtime. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the bug is vendor-confirmed via MongoDB Jira SERVER-124190.
Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the server process by issuing a specially crafted aggregation followed by a getMore command on the same cursor, triggering a null pointer dereference in the aggregation stage's _subPipeline field. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a credible availability threat for multi-tenant or shared MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive information disclosure in MongoDB Server affects deployments using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) when issuing $vectorSearch aggregation queries. Due to a flaw in client-side query analysis, literal values intended for encrypted fields inside $vectorSearch filter expressions are transmitted to the server as plaintext instead of ciphertext, defeating the confidentiality guarantee of client-side encryption. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
NoSQL injection in Parse Server's password reset and email verification endpoints allows unauthenticated attackers to extract authentication tokens by injecting MongoDB query operators through the unvalidated token parameter. Affected deployments running MongoDB with these features enabled are vulnerable to email verification bypass and password reset token theft. The vulnerability is fixed in versions 8.6.14 and 9.5.2-alpha.1.
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execute arbitrary code through malicious MongoDB dataset queries. The vulnerability affects users connecting Chartbrew to MongoDB databases for chart creation and has active public exploit code available. No patch is currently available for affected versions.
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary MongoDB operations.
MongoDB proxy port connections bypass connection accounting mechanisms, allowing unauthenticated remote attackers to exhaust server resources and trigger denial of service without authentication. Servers relying on connection limits for resource management are vulnerable to crashes when connection counts are artificially inflated through the proxy protocol. No patch is currently available for this high-severity issue affecting MongoDB deployments.
MongoDB instances are vulnerable to denial of service attacks when processing specially crafted unauthenticated messages that trigger memory exhaustion and server crashes. An unauthenticated remote attacker can exploit this vulnerability to disable MongoDB availability without requiring valid credentials or user interaction. No patch is currently available for this vulnerability.
Flagforge versions 2.3.2 and earlier suffer from a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint that accepts unvalidated usernames containing regex metacharacters, allowing unauthenticated remote attackers to trigger excessive CPU consumption and deny service to legitimate users. The MongoDB regex engine processes these malicious patterns inefficiently, making the platform unavailable without administrator intervention. No patch is currently available; users should implement WAF rules to filter regex metacharacters from username inputs as a temporary mitigation.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 53.5%.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Direct storage-engine writes to arbitrary internal MongoDB tables are possible through an authorization bypass in the applyOps command affecting MongoDB Server 8.3.0 through 8.3.8. An authenticated user holding elevated internal MongoDB privileges can specify a client-inaccessible internal replication mode value, circumventing a disabled production feature gate and enabling container operations that are suppressed by default. Because the authorization check validates only the operation's namespace rather than the actual storage engine target, the attacker can route writes to unrelated internal metadata or other collections' data, potentially corrupting database state. No public exploit has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when configured with a CA file, silently accepting connections from clients that present no certificate at all. Deployments that rely on client certificate authentication as the sole means of identifying users are fully exposed - any remote party with network access to the listener can establish a session and read all MongoDB data surfaced through the SQL interface. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-privilege nature of the flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is bounded by a specific non-default configuration prerequisite.
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.
Atlas Vector Search in MongoDB Server exposes a horizontal authorization bypass allowing an authenticated low-privileged user to read documents from a view they are not authorized to access, crossing view-level access control boundaries within the same underlying collection. The flaw arises from MongoDB Server insufficiently validating user-supplied fields before forwarding internal requests to the search process, enabling the search backend to return documents outside the scope of the caller's authorized view. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.
Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user holding only read-only privileges to crash the mongod process by submitting an aggregation pipeline that uses the $linearFill window function with a maliciously typed sortBy expression. Because the required privilege level is minimal (any read user) and the trigger is a single crafted query over the normal database wire protocol, a low-privilege account can repeatedly terminate the database node. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Denial of service in MongoDB allows an authenticated attacker to exhaust server CPU by submitting query operations that use deeply nested $jsonSchema validation constructs, producing a runaway CPU-bound operation that cannot be halted via standard administrative controls such as killOp. Reported by MongoDB's own CNA (SERVER-125872) and classified as inefficient algorithmic complexity (CWE-407), with no public exploit identified at time of analysis. The inability to interrupt the operation elevates this above a routine resource-consumption bug because normal recovery tooling is ineffective.
Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in MongoDB Server allows an authenticated user holding limited read privileges to read documents from collections they are not permitted to access, exploiting a discrepancy between how the $graphLookup aggregation stage is authorized versus how it is executed when the target collection is referenced inside an existing view's pipeline definition. The flaw (CWE-863, Incorrect Authorization) yields cross-collection data disclosure with no integrity or availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV; it was self-reported by MongoDB's CNA and tracked in SERVER-127357.
Authorization bypass in MongoDB Server allows an authenticated low-privileged user to read and write documents that should be shielded by role-based, query-level access controls. Because the server insufficiently validates certain client-supplied command parameters, crafted find, update, delete, and aggregate commands can sidestep the access boundaries enforced for a user's role. The flaw only manifests in non-apiStrict deployments (the default), and per the vendor CVSS 4.0 vector it yields high confidentiality and integrity impact; no public exploit has been identified at time of analysis.
Denial of service in MongoDB Server (mongod) allows an authenticated user holding only basic write privileges to crash the database process by submitting a crafted transaction command that omits some required fields. The inconsistent validation of related transaction parameters trips a fatal internal invariant (CWE-617), aborting mongod and interrupting availability for all clients. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; impact is limited to availability, with no data disclosure or integrity effect.
Denial of service in MongoDB Server allows an authenticated database user to submit an aggregation/query expression that generates very large arrays, forcing the server to allocate oversized intermediate objects in memory and crash with an out-of-memory (OOM) error. Reported by MongoDB's own CNA and tracked in SERVER-124355, the flaw carries a CVSS 4.0 base score of 7.1 with an availability-only impact (VA:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) lets any authenticated user with aggregation-pipeline privileges crash the database process by invoking the internal `$_internalIndexKey` aggregation expression against a compound wildcard index. The expression fails to handle compound wildcard index specifications, tripping an internal consistency check (assertion) that aborts the server. No public exploit identified at time of analysis, and the flaw is reported by MongoDB's own CNA as a Denial of Service issue with no confidentiality or integrity impact.
Memory disclosure and denial of service in MongoDB Server's server-side JavaScript engine allow an authenticated user with read privileges and JavaScript execution rights to read freed heap memory or crash the mongod process. The flaw is triggered during BSON-to-JavaScript array conversion when operators such as $where or $function are evaluated. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by MongoDB.
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. No public exploit identified at time of analysis, but the low-complexity, no-auth profile makes this a priority patch for internet-reachable MongoDB deployments.
Information disclosure in MongoDB Server allows authenticated users holding the read role to obtain small amounts of uninitialized stack memory by submitting specially-crafted filemd5 commands. The flaw stems from CWE-457 (Use of Uninitialized Variable) in the filemd5 command handler, and while no public exploit has been identified at time of analysis, the low attack complexity and network reachability make it a credible insider/credential-theft risk against MongoDB databases.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial query backed by a 2dsphere index where the indexed field holds a GeoJSON GeometryCollection containing a Polygon defined with a strict-winding CRS. The flaw is a CWE-476 null pointer dereference reached because the rejection guard for unsupported strict-winding polygons does not recurse into GeometryCollection members. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash the mongod process or obtain incorrect query results by inserting specially crafted documents. The root cause - insufficient separation between user-controlled document fields and internal execution metadata (CWE-617: Reachable Assertion) - means the attack surface is the normal document write workflow, requiring no elevated roles. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with this profile: network-reachable, low complexity, low-privilege; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pipelines that use the internal $exchange stage with key-range partitioning and order-preserving delivery. When a single key range fills its consumer buffer, the high watermark is not updated correctly, leading to a reachable assertion (CWE-617) and likely process termination. No public exploit identified at time of analysis.
Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an aggregation pipeline that places the $_internalConvertBucketIndexStats stage upstream of a $facet stage. The misuse of the internal PauseExecution signal trips a hard invariant assertion in TeeBuffer, terminating the database process. No public exploit identified at time of analysis, and the issue is tracked in MongoDB's internal tracker SERVER-123951.
Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting aggregation pipelines that combine the internal fromRouter:true flag with runtimeConstants.userRoles. No public exploit identified at time of analysis, but the bug is tracked in MongoDB's public JIRA (SERVER-123918), which makes the trigger conditions discoverable. Impact is limited to availability (VA:H) with no data exposure or integrity compromise.
Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with the internal $_requestReshardingResumeToken option and the exchange option, triggering a reachable invariant that crashes the mongod process. Any logged-in user with low privileges can repeatedly invoke the crash on default deployments, producing service-wide downtime. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the bug is vendor-confirmed via MongoDB Jira SERVER-124190.
Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the server process by issuing a specially crafted aggregation followed by a getMore command on the same cursor, triggering a null pointer dereference in the aggregation stage's _subPipeline field. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a credible availability threat for multi-tenant or shared MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive information disclosure in MongoDB Server affects deployments using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) when issuing $vectorSearch aggregation queries. Due to a flaw in client-side query analysis, literal values intended for encrypted fields inside $vectorSearch filter expressions are transmitted to the server as plaintext instead of ciphertext, defeating the confidentiality guarantee of client-side encryption. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
NoSQL injection in Parse Server's password reset and email verification endpoints allows unauthenticated attackers to extract authentication tokens by injecting MongoDB query operators through the unvalidated token parameter. Affected deployments running MongoDB with these features enabled are vulnerable to email verification bypass and password reset token theft. The vulnerability is fixed in versions 8.6.14 and 9.5.2-alpha.1.
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execute arbitrary code through malicious MongoDB dataset queries. The vulnerability affects users connecting Chartbrew to MongoDB databases for chart creation and has active public exploit code available. No patch is currently available for affected versions.
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary MongoDB operations.
MongoDB proxy port connections bypass connection accounting mechanisms, allowing unauthenticated remote attackers to exhaust server resources and trigger denial of service without authentication. Servers relying on connection limits for resource management are vulnerable to crashes when connection counts are artificially inflated through the proxy protocol. No patch is currently available for this high-severity issue affecting MongoDB deployments.
MongoDB instances are vulnerable to denial of service attacks when processing specially crafted unauthenticated messages that trigger memory exhaustion and server crashes. An unauthenticated remote attacker can exploit this vulnerability to disable MongoDB availability without requiring valid credentials or user interaction. No patch is currently available for this vulnerability.
Flagforge versions 2.3.2 and earlier suffer from a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint that accepts unvalidated usernames containing regex metacharacters, allowing unauthenticated remote attackers to trigger excessive CPU consumption and deny service to legitimate users. The MongoDB regex engine processes these malicious patterns inefficiently, making the platform unavailable without administrator intervention. No patch is currently available; users should implement WAF rules to filter regex metacharacters from username inputs as a temporary mitigation.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 53.5%.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.