Bitnami package
mongodb
pkg:bitnami/mongodb
Vulnerabilities (161)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-13069 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrade | |
| CVE-2026-13068 | Med | 4.2 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly | |
| CVE-2026-13067 | Med | 6.3 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios | |
| CVE-2026-13066 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments th | |
| CVE-2026-13065 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient v | |
| CVE-2026-13064 | Med | 6.5 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrativ | |
| CVE-2026-13063 | Med | 4.3 | >= 8.2.0, < 8.2.12 | 8.2.12 | Jul 22, 2026 | An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an | |
| CVE-2026-13062 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can | |
| CVE-2026-13061 | Med | 4.3 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, a | |
| CVE-2026-13060 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involv | |
| CVE-2026-13059 | Hig | 8.1 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and ag | |
| CVE-2026-13058 | Med | 6.5 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, r | |
| CVE-2026-13057 | Med | 5.3 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded se | |
| CVE-2026-13056 | Med | 6.5 | >= 8.0.0, < 8.0.28 | 8.0.28 | Jul 22, 2026 | Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error. | |
| CVE-2026-13055 | Med | 6.5 | >= 7.0.0, < 7.0.39 | 7.0.39 | Jul 22, 2026 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must | |
| CVE-2026-11933 | Hig | 8.8 | >= 4.4.0, < 4.4.31 | 4.4.31 | Jun 12, 2026 | A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the s | |
| CVE-2026-9754 | Med | 6.5 | >= 8.2.0, < 8.2.10 | 8.2.10 | Jun 9, 2026 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command | |
| CVE-2026-9753 | Hig | 8.1 | < 7.0.35 | 7.0.35 | Jun 9, 2026 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregat | |
| CVE-2026-9752 | Med | 6.5 | >= 7.0.0, < 7.0.35 | 7.0.35 | Jun 9, 2026 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rej | |
| CVE-2026-9751 | Med | 5.5 | >= 7.0.0, < 7.0.35 | 7.0.35 | Jun 9, 2026 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. |
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrade
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments th
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient v
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrativ
- affected >= 8.2.0, < 8.2.12fixed 8.2.12
An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, a
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involv
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and ag
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, r
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded se
- affected >= 8.0.0, < 8.0.28fixed 8.0.28
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.
- affected >= 7.0.0, < 7.0.39fixed 7.0.39
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must
- affected >= 4.4.0, < 4.4.31fixed 4.4.31
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the s
- affected >= 8.2.0, < 8.2.10fixed 8.2.10
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command
- affected < 7.0.35fixed 7.0.35
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregat
- affected >= 7.0.0, < 7.0.35fixed 7.0.35
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rej
- affected >= 7.0.0, < 7.0.35fixed 7.0.35
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
Page 4 of 9