Bitnami package
mongodb
pkg:bitnami/mongodb
Vulnerabilities (161)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-82056 | Med | 5.3 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structu | |
| CVE-2026-82055 | Med | 6.5 | >= 8.3.0, < 8.3.9 | 8.3.9 | Sep 8, 2026 | A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an int | |
| CVE-2026-82054 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total | |
| CVE-2026-82053 | Hig | 8.1 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rath | |
| CVE-2026-82052 | Med | 6.5 | >= 7.0.0, < 7.0.41 | 7.0.41 | Sep 8, 2026 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during | |
| CVE-2026-84967 | Med | 4.3 | >= 1.13.0, < 1.17.1 | 1.17.1 | Sep 3, 2026 | A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a | |
| CVE-2026-18712 | Hig | 8.1 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient valida | |
| CVE-2026-18711 | Hig | 7.1 | >= 7.0.0, < 7.0.41 | 7.0.41 | Aug 11, 2026 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could resu | |
| CVE-2026-18709 | Med | 6.4 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, clus | |
| CVE-2026-18708 | Med | 6.4 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycl | |
| CVE-2026-18707 | Med | 4.3 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service. | |
| CVE-2026-18706 | Med | 6.6 | >= 8.3.0, < 8.3.8 | 8.3.8 | Aug 11, 2026 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, pot | |
| CVE-2026-18705 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields | |
| CVE-2026-18704 | Med | 6.5 | >= 8.3.0, < 8.3.8 | 8.3.8 | Aug 11, 2026 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients w | |
| CVE-2026-18703 | Med | 4.2 | >= 8.2.0, < 8.3.8 | 8.3.8 | Aug 11, 2026 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. Th | |
| CVE-2026-18702 | Med | 6.4 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potent | |
| CVE-2026-18701 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service. | |
| CVE-2026-18700 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. T | |
| CVE-2026-18699 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, a | |
| CVE-2026-18698 | Med | 5.4 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment |
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structu
- affected >= 8.3.0, < 8.3.9fixed 8.3.9
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an int
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rath
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during
- affected >= 1.13.0, < 1.17.1fixed 1.17.1
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient valida
- affected >= 7.0.0, < 7.0.41fixed 7.0.41
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could resu
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, clus
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycl
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.
- affected >= 8.3.0, < 8.3.8fixed 8.3.8
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, pot
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields
- affected >= 8.3.0, < 8.3.8fixed 8.3.8
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients w
- affected >= 8.2.0, < 8.3.8fixed 8.3.8
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. Th
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potent
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. T
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, a
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment
Page 2 of 9