Bitnami package
mongodb
pkg:bitnami/mongodb
Vulnerabilities (161)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-18697 | Hig | 7.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections route | |
| CVE-2026-18696 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is du | |
| CVE-2026-18695 | Med | 6.5 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service. | |
| CVE-2026-18694 | Hig | 7.1 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the serv | |
| CVE-2026-18693 | Hig | 7.6 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result i | |
| CVE-2026-18692 | Hig | 8.8 | >= 8.0.0, < 8.0.29 | 8.0.29 | Aug 11, 2026 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potenti | |
| CVE-2026-18691 | Hig | 8.8 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared intern | |
| CVE-2026-18690 | Hig | 8.1 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreate | |
| CVE-2026-18688 | Hig | 7.1 | >= 7.0.0, < 7.0.40 | 7.0.40 | Aug 11, 2026 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may | |
| CVE-2026-18687 | Hig | 7.1 | >= 8.0.0, < 8.0.29 | 8.0.29 | Aug 11, 2026 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed reques | |
| CVE-2026-9737 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure. | |
| CVE-2026-13078 | Hig | 7.7 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated us | |
| CVE-2026-13077 | Hig | 7.1 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWSco | |
| CVE-2026-13076 | Med | 6.5 | >= 8.3.0, < 8.3.7 | 8.3.7 | Jul 22, 2026 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during t | |
| CVE-2026-13075 | Med | 6.5 | >= 8.2.0, < 8.2.12 | 8.2.12 | Jul 22, 2026 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries. | |
| CVE-2026-13074 | Med | 5.3 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throt | |
| CVE-2026-13073 | Med | 4.3 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selectio | |
| CVE-2026-13072 | Hig | 8.1 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuratio | |
| CVE-2026-13071 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing. | |
| CVE-2026-13070 | Med | 5.3 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remot |
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections route
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is du
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the serv
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result i
- affected >= 8.0.0, < 8.0.29fixed 8.0.29
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potenti
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared intern
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreate
- affected >= 7.0.0, < 7.0.40fixed 7.0.40
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may
- affected >= 8.0.0, < 8.0.29fixed 8.0.29
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed reques
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated us
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWSco
- affected >= 8.3.0, < 8.3.7fixed 8.3.7
An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during t
- affected >= 8.2.0, < 8.2.12fixed 8.2.12
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throt
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selectio
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuratio
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remot
Page 3 of 9