Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.
This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.
This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVE-2026-8053 is a high-severity vulnerability in MongoDB Server's time-series collection implementation. It allows an authenticated user with database write privileges to cause an out-of-bounds memory write in the mongod process due to an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. This flaw can lead to arbitrary code execution under certain conditions. The vulnerability affects multiple MongoDB Server versions prior to 5.0.33, 6.0.28, 7.0.34, 8.
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.
This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.
CVE-2026-8063 is a high-severity vulnerability in MongoDB Server versions 8.2.0 prior to 8.2.7. It allows an authenticated user to crash the mongod process by running $rankFusion or $scoreFusion aggregation stages with an empty pipeline on a view. The issue arises because the server attempts to read the first element of each stage's input pipeline array without checking if the array is empty, leading to a null pointer dereference and server crash.
CVE-2026-6691 is a high-severity vulnerability in the MongoDB C Driver version 2.1.0. It involves unsafe string copying in the Cyrus SASL integration during username canonicalization, leading to a heap buffer overflow. This flaw can be triggered by passing untrusted input in the username field of a MongoDB URI when using the GSSAPI authentication mechanism. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.
This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32
The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1
A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set.
This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
CVE-2026-4359 is a low-severity vulnerability in the MongoDB C Driver caused by improper neutralization of null byte characters (CWE-158). An attacker, such as a compromised third-party cloud server or a man-in-the-middle, can send a malformed HTTP response containing null bytes that triggers a crash in applications using this driver. Exploitation requires high privileges and user interaction, and the attack complexity is high. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily impacts the availability of applications relying on the MongoDB C Driver by causing crashes, but it does not affect confidentiality or integrity. Organizations using this driver in their infrastructure should monitor for updates from MongoDB Inc and consider network-level protections to mitigate man-in-the-middle risks. Countries with significant MongoDB usage and cloud infrastructure reliance are more likely to be affected. Overall, the threat is limited in scope and impact but should be addressed to maintain service stability.
CVE-2026-4148 is a high-severity use-after-free vulnerability in MongoDB Server versions 7.0, 8.0, and 8.2. It can be exploited by an authenticated user with read role privileges in sharded clusters by issuing a specially crafted $lookup or $graphLookup aggregation pipeline. This vulnerability does not require user interaction or elevated privileges beyond read access but can lead to high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The vulnerability stems from improper memory management (CWE-416) during aggregation operations in sharded environments. Organizations using affected MongoDB versions in sharded configurations should prioritize patching or mitigating this issue to prevent potential exploitation. The CVSS 4.
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
