Bitnami package
mongodb
pkg:bitnami/mongodb
Vulnerabilities (109)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-13078 | Hig | 7.7 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated us | |
| CVE-2026-13077 | Hig | 7.1 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWSco | |
| CVE-2026-13076 | Med | 6.5 | >= 8.3.0, < 8.3.7 | 8.3.7 | Jul 22, 2026 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during t | |
| CVE-2026-13075 | Med | 6.5 | >= 8.2.0, < 8.2.12 | 8.2.12 | Jul 22, 2026 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries. | |
| CVE-2026-13074 | Med | 5.3 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throt | |
| CVE-2026-13073 | Med | 4.3 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selectio | |
| CVE-2026-13072 | Hig | 8.1 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuratio | |
| CVE-2026-13071 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing. | |
| CVE-2026-13070 | Med | 5.3 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remot | |
| CVE-2026-13069 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrade | |
| CVE-2026-13068 | Med | 4.2 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly | |
| CVE-2026-13067 | Med | 6.3 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios | |
| CVE-2026-13066 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments th | |
| CVE-2026-13065 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient v | |
| CVE-2026-13064 | Med | 6.5 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrativ | |
| CVE-2026-13063 | Med | 4.3 | >= 8.2.0, < 8.2.12 | 8.2.12 | Jul 22, 2026 | An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an | |
| CVE-2026-13062 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can | |
| CVE-2026-13061 | Med | 4.3 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, a | |
| CVE-2026-13060 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involv | |
| CVE-2026-13059 | Hig | 8.1 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and ag |
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated us
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWSco
- affected >= 8.3.0, < 8.3.7fixed 8.3.7
An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during t
- affected >= 8.2.0, < 8.2.12fixed 8.2.12
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throt
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selectio
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuratio
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remot
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrade
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments th
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient v
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrativ
- affected >= 8.2.0, < 8.2.12fixed 8.2.12
An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, a
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involv
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and ag
Page 1 of 6