A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices.
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate.
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
CVE-2026-84968 is an out-of-bounds read vulnerability in the BSON decoding component of the MongoDB PHP driver. An unauthenticated attacker can supply specially crafted input to trigger this flaw, causing a small amount of adjacent process memory to be copied into an error message returned to the application. This may lead to unintended disclosure of limited memory contents. The vulnerability affects multiple version ranges of the MongoDB PHP driver. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-84965 is an integer wraparound vulnerability in the BSON library's JSON parsing code used by the MongoDB C Driver. It occurs during allocation size calculation, which may lead to freeing a buffer while a subsequent copy operation writes to a stale pointer. On 32-bit size builds, an unauthenticated attacker can supply a large JSON input to cause the application to crash, resulting in denial of service. The vulnerability affects MongoDB C Driver versions from 1.10.0 up to but not including 1.30.9, and from 2.0.0 up to but not including 2.5.2. The CVSS 4.0 base score is 5.9, indicating medium severity.
CVE-2026-84964 is a high-severity double free vulnerability in the MongoDB C Driver affecting versions 1.17.0 up to but not including 1.30.9, and 2.0.0 up to but not including 2.5.2. It occurs in the OpenSSL-based TLS certificate revocation checking path during the TLS handshake when specially crafted certificate data causes the same heap object to be freed twice. This can lead to unexpected termination of the client application. The vulnerability can be triggered by an unauthenticated party acting as a trusted TLS endpoint.
CVE-2026-84963 is a vulnerability in the MongoDB C Driver's BSON library where incorrect numeric conversion during JSON parsing can cause large text values to be truncated or omitted without error. This can lead to applications holding altered data that does not match the original input. The issue affects certain versions of the MongoDB C Driver and can be triggered by unauthenticated input.
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.
CVE-2026-84971 is a high-severity vulnerability in MongoDB's libmongocrypt library, specifically a reachable assertion failure caused by improper handling of unexpected value sizes during decryption. An attacker who can supply a specially crafted encrypted value to an application using this library may cause the application to terminate unexpectedly.
CVE-2026-84969 is a medium severity vulnerability in the MongoDB C Driver affecting versions >=1.30.0 <1.30.9 and >=2.0.0 <2.5.2. It involves an out-of-bounds write during BSON-to-JSON conversion when encoding a binary field with a caller-configured length limit. An unprivileged attacker supplying document content may cause a small amount of data outside the intended buffer to be altered.
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.