VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jun 9, 2026· Updated Jun 15, 2026

CVE-2026-9748

CVE-2026-9748

Description

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • MongoDB/MongoDB2 versions
    cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.35
    • (no CPE)
  • osv-coords
    pkg:bitnami/mongodb
    Range: >= 7.0.0, < 7.0.35

Patches

Vulnerability mechanics

References

1

News mentions

1