Bitnami package
mongodb
pkg:bitnami/mongodb
Vulnerabilities (161)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-89099 | Hig | 7.5 | >= 7.0.0, < 7.0.43 | 7.0.43 | Sep 11, 2026 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able | |
| CVE-2026-82076 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound du | |
| CVE-2026-82075 | Hig | 7.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend | |
| CVE-2026-82074 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than | |
| CVE-2026-82073 | Med | 6.5 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient | |
| CVE-2026-82071 | Hig | 8.1 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in t | |
| CVE-2026-82070 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Sep 8, 2026 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, b | |
| CVE-2026-82069 | Low | 2.7 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechan | |
| CVE-2026-82068 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on resta | |
| CVE-2026-82067 | Hig | 8.1 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition oc | |
| CVE-2026-82066 | Med | 4.3 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buf | |
| CVE-2026-82065 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once per | |
| CVE-2026-82064 | Hig | 7.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's a | |
| CVE-2026-82063 | Med | 5.3 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently derefere | |
| CVE-2026-82062 | Med | 5.5 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables executio | |
| CVE-2026-82061 | Hig | 8.1 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential mem | |
| CVE-2026-82060 | Med | 5.4 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed | |
| CVE-2026-82059 | Med | 5.3 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read | |
| CVE-2026-82058 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error ge | |
| CVE-2026-82057 | Med | 6.5 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type |
- affected >= 7.0.0, < 7.0.43fixed 7.0.43
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound du
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in t
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, b
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechan
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on resta
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition oc
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buf
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once per
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's a
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently derefere
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables executio
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential mem
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error ge
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type
Page 1 of 9