Mongodb Server
Monthly
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Direct storage-engine writes to arbitrary internal MongoDB tables are possible through an authorization bypass in the applyOps command affecting MongoDB Server 8.3.0 through 8.3.8. An authenticated user holding elevated internal MongoDB privileges can specify a client-inaccessible internal replication mode value, circumventing a disabled production feature gate and enabling container operations that are suppressed by default. Because the authorization check validates only the operation's namespace rather than the actual storage engine target, the attacker can route writes to unrelated internal metadata or other collections' data, potentially corrupting database state. No public exploit has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.
Atlas Vector Search in MongoDB Server exposes a horizontal authorization bypass allowing an authenticated low-privileged user to read documents from a view they are not authorized to access, crossing view-level access control boundaries within the same underlying collection. The flaw arises from MongoDB Server insufficiently validating user-supplied fields before forwarding internal requests to the search process, enabling the search backend to return documents outside the scope of the caller's authorized view. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. No public exploit identified at time of analysis, but the low-complexity, no-auth profile makes this a priority patch for internet-reachable MongoDB deployments.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial query backed by a 2dsphere index where the indexed field holds a GeoJSON GeometryCollection containing a Polygon defined with a strict-winding CRS. The flaw is a CWE-476 null pointer dereference reached because the rejection guard for unsupported strict-winding polygons does not recurse into GeometryCollection members. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash the mongod process or obtain incorrect query results by inserting specially crafted documents. The root cause - insufficient separation between user-controlled document fields and internal execution metadata (CWE-617: Reachable Assertion) - means the attack surface is the normal document write workflow, requiring no elevated roles. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with this profile: network-reachable, low complexity, low-privilege; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pipelines that use the internal $exchange stage with key-range partitioning and order-preserving delivery. When a single key range fills its consumer buffer, the high watermark is not updated correctly, leading to a reachable assertion (CWE-617) and likely process termination. No public exploit identified at time of analysis.
Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an aggregation pipeline that places the $_internalConvertBucketIndexStats stage upstream of a $facet stage. The misuse of the internal PauseExecution signal trips a hard invariant assertion in TeeBuffer, terminating the database process. No public exploit identified at time of analysis, and the issue is tracked in MongoDB's internal tracker SERVER-123951.
Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting aggregation pipelines that combine the internal fromRouter:true flag with runtimeConstants.userRoles. No public exploit identified at time of analysis, but the bug is tracked in MongoDB's public JIRA (SERVER-123918), which makes the trigger conditions discoverable. Impact is limited to availability (VA:H) with no data exposure or integrity compromise.
Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with the internal $_requestReshardingResumeToken option and the exchange option, triggering a reachable invariant that crashes the mongod process. Any logged-in user with low privileges can repeatedly invoke the crash on default deployments, producing service-wide downtime. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the bug is vendor-confirmed via MongoDB Jira SERVER-124190.
Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the server process by issuing a specially crafted aggregation followed by a getMore command on the same cursor, triggering a null pointer dereference in the aggregation stage's _subPipeline field. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a credible availability threat for multi-tenant or shared MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive information disclosure in MongoDB Server affects deployments using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) when issuing $vectorSearch aggregation queries. Due to a flaw in client-side query analysis, literal values intended for encrypted fields inside $vectorSearch filter expressions are transmitted to the server as plaintext instead of ciphertext, defeating the confidentiality guarantee of client-side encryption. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server 7.0, 8.0, and 8.2 allows authenticated remote attackers to crash the database by inserting documents that trigger updates to a maliciously created '2dsphere_bucket' or 'queryable_encrypted_range' index on a non-timeseries bucket collection. The flaw stems from a reachable assertion (CWE-617) and is reported by MongoDB itself with a vendor patch available; no public exploit identified at time of analysis.
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or mapreduce map functions) with subsequent JavaScript engine invocations ($where, $function, mapreduce reduce stages), triggering a use-after-free condition. Affects MongoDB Server 7.0 (prior to 7.0.34), 8.0 (prior to 8.0.23), 8.2 (prior to 8.2.9), and 8.3 (prior to 8.3.2). Vendor-released patches available for all affected branches. No public exploit identified at time of analysis; EPSS score of 0.05% (16th percentile) suggests low observed exploitation probability despite 7.7 CVSS score. The CWE-416 use-after-free root cause requires precise sequencing of JavaScript operations, limiting exploitability.
Authenticated attackers can exhaust MongoDB Server memory using malicious bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear), leading to out-of-memory denial of service. Affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. Vendor-released patches are available across all affected major versions. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability in the wild, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server 8.2 before version 8.2.7 crashes when an authenticated user supplies an empty pipeline to $rankFusion or $scoreFusion aggregation operators on a view. The server fails to validate that the pipeline array is non-empty before accessing its first element during view resolution, resulting in a null pointer dereference that terminates the mongod process. This denial-of-service condition requires database authentication but can be triggered remotely via aggregation queries.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read permissions execute malicious $lookup or $graphLookup aggregation pipeline operations. An attacker can exploit this vulnerability to achieve high-impact outcomes including information disclosure, data manipulation, and denial of service. No patch is currently available for this vulnerability.
An authenticated user with read-only role can extract limited amounts of uninitialized stack memory through specially crafted issuances of the filemd5 command in MongoDB Server. This information disclosure vulnerability affects MongoDB Server versions 8.2 prior to 8.2.6, 8.0 prior to 8.0.20, and 7.0 prior to 7.0.31. An attacker with valid database read credentials can exploit this to leak sensitive data from process memory without requiring elevated privileges or user interaction.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Use-after-free in MongoDB Server's cursor management component allows an authenticated remote attacker to crash the mongod server process, causing a denial of service. Under specific timing conditions during cursor lifecycle events, a stale pointer to a freed resource is retained and later dereferenced during cursor cleanup, producing undefined behavior and a process crash. Affected branches are MongoDB 7.0.x before 7.0.41, 8.0.x before 8.0.30, and 8.3.x before 8.3.9; vendor-patched releases are available, and no public exploit code is identified at time of analysis.
Change stream data corruption in MongoDB Server (versions 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8) enables authenticated database users to insert documents with operator-shaped objects as shard key values that bypass insertion validation in sharded collections. When downstream change stream consumers operate in updateLookup full document mode, these stored values are embedded unsanitized into internal post-image lookup queries, causing MongoDB's query engine to interpret them as operator expressions rather than literal equality predicates. The practical result is that change stream consumers either receive incorrect post-image documents from unrelated records or encounter non-resumable fatal errors that break real-time data pipelines; no public exploit has been identified and vendor-released patches are available across all three affected release trains.
Denial of service in MongoDB Server allows any authenticated user - including those with only read-only privileges - to crash the mongod process by exploiting an internal aggregation expression that was incorrectly registered as user-accessible rather than restricted to internal cluster operations. Submitting a malformed index specification within this expression triggers an assertion failure (CWE-617) in the index key generation code path. In affected build configurations, this assertion failure terminates the mongod process, severing all active client connections. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low privilege requirement (read-only user) makes this a realistic insider or compromised-credential threat.
Heap use-after-free in MongoDB Server's text index query parser allows authenticated users with readWrite privileges to crash the server process through deliberate concurrent operations. By combining upsert retry text-search queries with concurrent index lifecycle operations (create/drop) on the same collection, an attacker can trigger a race window where a raw pointer to freed text index metadata structures is dereferenced, aborting the mongod process and causing denial of service for all connected clients. No public exploit has been identified; vendor patches are available for all three affected release lines (7.0.x, 8.0.x, 8.3.x).
MongoDB Server's sharded cluster transaction coordination is vulnerable to an authorization bypass that allows an authenticated, low-privileged user with direct adjacent-network access to a shard process to illegitimately commit or abort in-progress prepared transactions - actions that are normally reserved for the designated transaction coordinator. Exploitation can produce cross-shard data inconsistency, cluster clock corruption, and broken atomicity guarantees across the distributed database. No public exploit code exists and SSVC confirms no active exploitation; however, successful abuse could silently corrupt application-layer data integrity across the cluster.
Insufficient privilege enforcement in MongoDB Server allows an authenticated user holding only a limited database-scoped role to operate against protected system collections normally restricted to higher-privilege roles. Affected versions span the 7.0, 8.0, and 8.3 release lines. Depending on deployment configuration, exploitation can expose collection metadata or enable unauthorized modification of system collection data. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation.
MongoDB Server's query planner contains a null pointer dereference (CWE-476) that enables any authenticated user holding read-level privileges to crash the server process by submitting a specially crafted query against a collection with a text index. Affected branches span MongoDB 7.0.x, 8.0.x, and 8.3.x, with fixed releases available in 7.0.40, 8.0.29, and 8.3.8 respectively. No public exploit or active exploitation is identified; SSVC rates exploitation as none and the attack is not automatable, though the availability impact is total for the targeted server instance.
Privilege boundary enforcement failure in MongoDB Server allows an authenticated user holding only database-scoped privileges to modify diagnostic logging parameters at the server-wide level. Affected versions span MongoDB 7.0 (before 7.0.40), 8.0 (before 8.0.29), and 8.3 (before 8.3.8). An attacker with low-privilege credentials can either suppress server-wide diagnostic logging to obscure unauthorized activity or flood logs to degrade operational monitoring - effectively undermining the integrity of the audit and observability layer. No public exploit code exists and CISA has not added this to the KEV catalog.
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
Use-after-free in MongoDB Server's geospatial validation subsystem allows an authenticated user with write privileges to crash the database server through concurrent operations against a collection using a specific validator type. Affected branches are MongoDB 7.0 (prior to 7.0.40), 8.0 (prior to 8.0.29), and 8.3.x (prior to 8.3.8), per EUVD advisory EUVD-2026-56913. No public exploit code exists and SSVC assessment indicates no current exploitation activity; patched releases are available from MongoDB.
MongoDB Server 8.3.0 through 8.3.7 can be crashed by any authenticated user - including accounts with zero assigned privileges - by submitting a specially crafted aggregation command. The root cause is a reachable assertion (CWE-617) that, when triggered, causes the mongod process to terminate unexpectedly, resulting in a denial of service for all connected clients. No public exploit or active exploitation has been identified at time of analysis, and the vendor has released a patch in version 8.3.8.
MongoDB Server 8.3.x through 8.3.7 permits certificate-based authentication to succeed for a client holding a valid x.509 certificate and a corresponding user account, even when the administrator has explicitly configured the server to restrict allowable authentication mechanisms to other methods such as SCRAM. The vulnerability undermines deliberate access-control policy decisions rather than enabling unauthenticated access, meaning the attacker must already possess legitimate credential material. With a CVSS 4.0 score of 2.3, CISA SSVC exploitation status of 'none', and no public exploit identified at time of analysis, this is a low-urgency compliance and policy-integrity issue rather than an imminent exploitation threat.
MongoDB Server leaks SASL authentication credentials into plaintext server logs when connection health metric logging is enabled, exposing database passwords to any local actor with log file read access. The flaw (CWE-532) affects all versions per the available CPE data and was self-disclosed by MongoDB, indicating a vendor-acknowledged issue without a confirmed patch version at time of analysis. A low-privileged local attacker who can read the MongoDB log directory can harvest credentials and authenticate directly to the database - no public exploit exists at time of analysis, and it is not listed in the CISA KEV catalog.
Plaintext credential exposure in MongoDB Server allows a local authenticated attacker to retrieve the LDAP query password from log files. When an administrator uses the runtime setParameter command to configure the ldapQueryPassword parameter, MongoDB writes the new password value to mongod.log in cleartext. Any local user with read access to the log file - a broad class on many deployments - can silently capture these credentials and use them to authenticate against or query the connected LDAP directory. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in MongoDB Server v7.0 through v8.3 allows authenticated users with aggregation permissions to exhaust CPU resources via densely populated character masks in $trim, $ltrim, and $rtrim aggregation operators. An attacker can pin CPU utilization at 100% for extended periods by crafting malicious aggregation queries with large input strings and computationally expensive mask patterns. No public exploit code or active exploitation has been reported at time of analysis.
Use-after-free in MongoDB Server's Field-Level Encryption query analysis component allows authenticated remote attackers with control over FLE query structure to cause information disclosure and denial of service. The vulnerability affects mongocryptd and crypt_shared in versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. No public exploit code identified at time of analysis.
MongoDB Server fails to fully redact user data in local server log messages when schema validation is enabled and an update or insert operation violates the collection schema, allowing authenticated administrators to access sensitive information through log inspection. This information disclosure affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The vulnerability requires high-privilege administrative access and has a low CVSS score of 2.7, indicating limited real-world impact despite confirmed patch availability.
MongoDB Server's user management command contains an authorization flaw allowing authenticated low-privilege users to make limited modifications to authentication-related data belonging to other user accounts. Affected across three active release branches (7.0.x, 8.0.x, 8.2.x), this could allow one MongoDB user to interfere with how authentication is processed for another account - a form of limited horizontal privilege escalation. No public exploit exists and SSVC confirms no observed exploitation, but the network-accessible attack vector and low authentication requirement warrant timely patching in multi-tenant or shared MongoDB environments.
Denial of service in MongoDB Server allows authenticated users with limited cluster privileges to crash a mongod process during replica set to sharded cluster promotion, causing potential primary failure. Affects MongoDB 8.2 before 8.2.2, 8.0.18+, and 7.0.31+. No public exploit code or active exploitation confirmed; CVSS 5.3 reflects the narrow attack window and authentication requirement.
Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. The attack requires network access and specific query construction, limiting the practical exploit window.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Direct storage-engine writes to arbitrary internal MongoDB tables are possible through an authorization bypass in the applyOps command affecting MongoDB Server 8.3.0 through 8.3.8. An authenticated user holding elevated internal MongoDB privileges can specify a client-inaccessible internal replication mode value, circumventing a disabled production feature gate and enabling container operations that are suppressed by default. Because the authorization check validates only the operation's namespace rather than the actual storage engine target, the attacker can route writes to unrelated internal metadata or other collections' data, potentially corrupting database state. No public exploit has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.
Atlas Vector Search in MongoDB Server exposes a horizontal authorization bypass allowing an authenticated low-privileged user to read documents from a view they are not authorized to access, crossing view-level access control boundaries within the same underlying collection. The flaw arises from MongoDB Server insufficiently validating user-supplied fields before forwarding internal requests to the search process, enabling the search backend to return documents outside the scope of the caller's authorized view. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod process by sending a crafted message containing nested binary structures that trigger uncontrolled mutual recursion. The CVSS 4.0 score of 8.7 reflects high availability impact with network attack vector and no authentication required. No public exploit identified at time of analysis, but the low-complexity, no-auth profile makes this a priority patch for internet-reachable MongoDB deployments.
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privileges to crash the database or read out-of-bounds memory by submitting a malformed binary diff through the $_internalApplyOplogUpdate aggregation pipeline stage. The flaw stems from inadequate validation of the binary diff document structure consumed by an internal oplog replay operator that is unexpectedly reachable from user-facing aggregation queries. No public exploit identified at time of analysis, but the low privilege bar and network attack vector make this a meaningful threat in multi-tenant or shared-credential MongoDB deployments.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by issuing a geospatial query backed by a 2dsphere index where the indexed field holds a GeoJSON GeometryCollection containing a Polygon defined with a strict-winding CRS. The flaw is a CWE-476 null pointer dereference reached because the rejection guard for unsupported strict-winding polygons does not recurse into GeometryCollection members. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
MongoDB Server exposes an availability and data integrity risk allowing any low-privileged authenticated user to crash the mongod process or obtain incorrect query results by inserting specially crafted documents. The root cause - insufficient separation between user-controlled document fields and internal execution metadata (CWE-617: Reachable Assertion) - means the attack surface is the normal document write workflow, requiring no elevated roles. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with this profile: network-reachable, low complexity, low-privilege; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in MongoDB Server allows authenticated users to trigger an assertion failure by running aggregation pipelines that use the internal $exchange stage with key-range partitioning and order-preserving delivery. When a single key range fills its consumer buffer, the high watermark is not updated correctly, leading to a reachable assertion (CWE-617) and likely process termination. No public exploit identified at time of analysis.
Remote denial-of-service in MongoDB Server allows an authenticated user to crash the mongod process by submitting an aggregation pipeline that places the $_internalConvertBucketIndexStats stage upstream of a $facet stage. The misuse of the internal PauseExecution signal trips a hard invariant assertion in TeeBuffer, terminating the database process. No public exploit identified at time of analysis, and the issue is tracked in MongoDB's internal tracker SERVER-123951.
Denial of service in MongoDB Server allows authenticated remote attackers to crash the database process by submitting aggregation pipelines that combine the internal fromRouter:true flag with runtimeConstants.userRoles. No public exploit identified at time of analysis, but the bug is tracked in MongoDB's public JIRA (SERVER-123918), which makes the trigger conditions discoverable. Impact is limited to availability (VA:H) with no data exposure or integrity compromise.
Denial of service in MongoDB Server occurs when an authenticated user issues a $changeStreams aggregation combined with the internal $_requestReshardingResumeToken option and the exchange option, triggering a reachable invariant that crashes the mongod process. Any logged-in user with low privileges can repeatedly invoke the crash on default deployments, producing service-wide downtime. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the bug is vendor-confirmed via MongoDB Jira SERVER-124190.
Denial of service in MongoDB Server 8.0 allows authenticated users with aggregation pipeline privileges to crash the server process by issuing a specially crafted aggregation followed by a getMore command on the same cursor, triggering a null pointer dereference in the aggregation stage's _subPipeline field. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a credible availability threat for multi-tenant or shared MongoDB deployments.
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database process by submitting a crafted 'mechanism' value to the 'authenticate' command when OIDC authentication is configured. The flaw carries a CVSS 4.0 base score of 8.2 driven by network reachability, no privileges required, and high availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive information disclosure in MongoDB Server affects deployments using Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) when issuing $vectorSearch aggregation queries. Due to a flaw in client-side query analysis, literal values intended for encrypted fields inside $vectorSearch filter expressions are transmitted to the server as plaintext instead of ciphertext, defeating the confidentiality guarantee of client-side encryption. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server 7.0, 8.0, and 8.2 allows authenticated remote attackers to crash the database by inserting documents that trigger updates to a maliciously created '2dsphere_bucket' or 'queryable_encrypted_range' index on a non-timeseries bucket collection. The flaw stems from a reachable assertion (CWE-617) and is reported by MongoDB itself with a vendor patch available; no public exploit identified at time of analysis.
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or mapreduce map functions) with subsequent JavaScript engine invocations ($where, $function, mapreduce reduce stages), triggering a use-after-free condition. Affects MongoDB Server 7.0 (prior to 7.0.34), 8.0 (prior to 8.0.23), 8.2 (prior to 8.2.9), and 8.3 (prior to 8.3.2). Vendor-released patches available for all affected branches. No public exploit identified at time of analysis; EPSS score of 0.05% (16th percentile) suggests low observed exploitation probability despite 7.7 CVSS score. The CWE-416 use-after-free root cause requires precise sequencing of JavaScript operations, limiting exploitability.
Authenticated attackers can exhaust MongoDB Server memory using malicious bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear), leading to out-of-memory denial of service. Affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. Vendor-released patches are available across all affected major versions. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability in the wild, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server 8.2 before version 8.2.7 crashes when an authenticated user supplies an empty pipeline to $rankFusion or $scoreFusion aggregation operators on a view. The server fails to validate that the pipeline array is non-empty before accessing its first element during view resolution, resulting in a null pointer dereference that terminates the mongod process. This denial-of-service condition requires database authentication but can be triggered remotely via aggregation queries.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read permissions execute malicious $lookup or $graphLookup aggregation pipeline operations. An attacker can exploit this vulnerability to achieve high-impact outcomes including information disclosure, data manipulation, and denial of service. No patch is currently available for this vulnerability.
An authenticated user with read-only role can extract limited amounts of uninitialized stack memory through specially crafted issuances of the filemd5 command in MongoDB Server. This information disclosure vulnerability affects MongoDB Server versions 8.2 prior to 8.2.6, 8.0 prior to 8.0.20, and 7.0 prior to 7.0.31. An attacker with valid database read credentials can exploit this to leak sensitive data from process memory without requiring elevated privileges or user interaction.
Query statistics serialization on the MongoDB sharded cluster router (mongos) fails to apply redaction to search query literals, exposing sensitive data to holders of the monitoring privilege. An improper conditional check in the serialization logic causes the redaction mechanism to be bypassed specifically for search queries transiting the router, leaving raw query text - which may contain PII, credentials embedded in queries, or proprietary data - stored and accessible via the queryStats interface. Affected versions are MongoDB Server 8.3.0 through 8.3.8; a fix is available in 8.3.9. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Heap out-of-bounds read in MongoDB Server's query planning component allows an authenticated database user with read/write privileges to disclose partial server heap memory contents. Crafted query operations cause the server to read beyond allocated heap buffer boundaries during query plan construction, with leaked memory fragments surfacing through diagnostic query statistics output. Affected releases span MongoDB Server 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8, with fixed versions available across all three branches per vendor advisory SERVER-131562.
Use-after-free in MongoDB Server's cursor management component allows an authenticated remote attacker to crash the mongod server process, causing a denial of service. Under specific timing conditions during cursor lifecycle events, a stale pointer to a freed resource is retained and later dereferenced during cursor cleanup, producing undefined behavior and a process crash. Affected branches are MongoDB 7.0.x before 7.0.41, 8.0.x before 8.0.30, and 8.3.x before 8.3.9; vendor-patched releases are available, and no public exploit code is identified at time of analysis.
Change stream data corruption in MongoDB Server (versions 7.0.0-7.0.40, 8.0.0-8.0.29, and 8.3.0-8.3.8) enables authenticated database users to insert documents with operator-shaped objects as shard key values that bypass insertion validation in sharded collections. When downstream change stream consumers operate in updateLookup full document mode, these stored values are embedded unsanitized into internal post-image lookup queries, causing MongoDB's query engine to interpret them as operator expressions rather than literal equality predicates. The practical result is that change stream consumers either receive incorrect post-image documents from unrelated records or encounter non-resumable fatal errors that break real-time data pipelines; no public exploit has been identified and vendor-released patches are available across all three affected release trains.
Denial of service in MongoDB Server allows any authenticated user - including those with only read-only privileges - to crash the mongod process by exploiting an internal aggregation expression that was incorrectly registered as user-accessible rather than restricted to internal cluster operations. Submitting a malformed index specification within this expression triggers an assertion failure (CWE-617) in the index key generation code path. In affected build configurations, this assertion failure terminates the mongod process, severing all active client connections. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low privilege requirement (read-only user) makes this a realistic insider or compromised-credential threat.
Heap use-after-free in MongoDB Server's text index query parser allows authenticated users with readWrite privileges to crash the server process through deliberate concurrent operations. By combining upsert retry text-search queries with concurrent index lifecycle operations (create/drop) on the same collection, an attacker can trigger a race window where a raw pointer to freed text index metadata structures is dereferenced, aborting the mongod process and causing denial of service for all connected clients. No public exploit has been identified; vendor patches are available for all three affected release lines (7.0.x, 8.0.x, 8.3.x).
MongoDB Server's sharded cluster transaction coordination is vulnerable to an authorization bypass that allows an authenticated, low-privileged user with direct adjacent-network access to a shard process to illegitimately commit or abort in-progress prepared transactions - actions that are normally reserved for the designated transaction coordinator. Exploitation can produce cross-shard data inconsistency, cluster clock corruption, and broken atomicity guarantees across the distributed database. No public exploit code exists and SSVC confirms no active exploitation; however, successful abuse could silently corrupt application-layer data integrity across the cluster.
Insufficient privilege enforcement in MongoDB Server allows an authenticated user holding only a limited database-scoped role to operate against protected system collections normally restricted to higher-privilege roles. Affected versions span the 7.0, 8.0, and 8.3 release lines. Depending on deployment configuration, exploitation can expose collection metadata or enable unauthorized modification of system collection data. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation.
MongoDB Server's query planner contains a null pointer dereference (CWE-476) that enables any authenticated user holding read-level privileges to crash the server process by submitting a specially crafted query against a collection with a text index. Affected branches span MongoDB 7.0.x, 8.0.x, and 8.3.x, with fixed releases available in 7.0.40, 8.0.29, and 8.3.8 respectively. No public exploit or active exploitation is identified; SSVC rates exploitation as none and the attack is not automatable, though the availability impact is total for the targeted server instance.
Privilege boundary enforcement failure in MongoDB Server allows an authenticated user holding only database-scoped privileges to modify diagnostic logging parameters at the server-wide level. Affected versions span MongoDB 7.0 (before 7.0.40), 8.0 (before 8.0.29), and 8.3 (before 8.3.8). An attacker with low-privilege credentials can either suppress server-wide diagnostic logging to obscure unauthorized activity or flood logs to degrade operational monitoring - effectively undermining the integrity of the audit and observability layer. No public exploit code exists and CISA has not added this to the KEV catalog.
MongoDB Server's JavaScript scripting engine allows an authenticated user with write privileges to inject code into the query execution scope of other database users via a specially crafted stored value processed during an internal maintenance cycle. Affected versions span the 7.0, 8.0, and 8.3 release lines, with vendor-confirmed patches available. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog; however, the cross-user integrity and availability impact warrants prompt patching in multi-tenant or shared database environments.
Use-after-free in MongoDB Server's geospatial validation subsystem allows an authenticated user with write privileges to crash the database server through concurrent operations against a collection using a specific validator type. Affected branches are MongoDB 7.0 (prior to 7.0.40), 8.0 (prior to 8.0.29), and 8.3.x (prior to 8.3.8), per EUVD advisory EUVD-2026-56913. No public exploit code exists and SSVC assessment indicates no current exploitation activity; patched releases are available from MongoDB.
MongoDB Server 8.3.0 through 8.3.7 can be crashed by any authenticated user - including accounts with zero assigned privileges - by submitting a specially crafted aggregation command. The root cause is a reachable assertion (CWE-617) that, when triggered, causes the mongod process to terminate unexpectedly, resulting in a denial of service for all connected clients. No public exploit or active exploitation has been identified at time of analysis, and the vendor has released a patch in version 8.3.8.
MongoDB Server 8.3.x through 8.3.7 permits certificate-based authentication to succeed for a client holding a valid x.509 certificate and a corresponding user account, even when the administrator has explicitly configured the server to restrict allowable authentication mechanisms to other methods such as SCRAM. The vulnerability undermines deliberate access-control policy decisions rather than enabling unauthenticated access, meaning the attacker must already possess legitimate credential material. With a CVSS 4.0 score of 2.3, CISA SSVC exploitation status of 'none', and no public exploit identified at time of analysis, this is a low-urgency compliance and policy-integrity issue rather than an imminent exploitation threat.
MongoDB Server leaks SASL authentication credentials into plaintext server logs when connection health metric logging is enabled, exposing database passwords to any local actor with log file read access. The flaw (CWE-532) affects all versions per the available CPE data and was self-disclosed by MongoDB, indicating a vendor-acknowledged issue without a confirmed patch version at time of analysis. A low-privileged local attacker who can read the MongoDB log directory can harvest credentials and authenticate directly to the database - no public exploit exists at time of analysis, and it is not listed in the CISA KEV catalog.
Plaintext credential exposure in MongoDB Server allows a local authenticated attacker to retrieve the LDAP query password from log files. When an administrator uses the runtime setParameter command to configure the ldapQueryPassword parameter, MongoDB writes the new password value to mongod.log in cleartext. Any local user with read access to the log file - a broad class on many deployments - can silently capture these credentials and use them to authenticate against or query the connected LDAP directory. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in MongoDB Server v7.0 through v8.3 allows authenticated users with aggregation permissions to exhaust CPU resources via densely populated character masks in $trim, $ltrim, and $rtrim aggregation operators. An attacker can pin CPU utilization at 100% for extended periods by crafting malicious aggregation queries with large input strings and computationally expensive mask patterns. No public exploit code or active exploitation has been reported at time of analysis.
Use-after-free in MongoDB Server's Field-Level Encryption query analysis component allows authenticated remote attackers with control over FLE query structure to cause information disclosure and denial of service. The vulnerability affects mongocryptd and crypt_shared in versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. No public exploit code identified at time of analysis.
MongoDB Server fails to fully redact user data in local server log messages when schema validation is enabled and an update or insert operation violates the collection schema, allowing authenticated administrators to access sensitive information through log inspection. This information disclosure affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The vulnerability requires high-privilege administrative access and has a low CVSS score of 2.7, indicating limited real-world impact despite confirmed patch availability.
MongoDB Server's user management command contains an authorization flaw allowing authenticated low-privilege users to make limited modifications to authentication-related data belonging to other user accounts. Affected across three active release branches (7.0.x, 8.0.x, 8.2.x), this could allow one MongoDB user to interfere with how authentication is processed for another account - a form of limited horizontal privilege escalation. No public exploit exists and SSVC confirms no observed exploitation, but the network-accessible attack vector and low authentication requirement warrant timely patching in multi-tenant or shared MongoDB environments.
Denial of service in MongoDB Server allows authenticated users with limited cluster privileges to crash a mongod process during replica set to sharded cluster promotion, causing potential primary failure. Affects MongoDB 8.2 before 8.2.2, 8.0.18+, and 7.0.31+. No public exploit code or active exploitation confirmed; CVSS 5.3 reflects the narrow attack window and authentication requirement.
Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. The attack requires network access and specific query construction, limiting the practical exploit window.