Server
by MongoDB
Source repositories
CVEs (114)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-18701 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service. | ||
| CVE-2026-18700 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator.… | ||
| CVE-2026-18699 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service,… | ||
| CVE-2026-18696 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is… | ||
| CVE-2026-18695 | Med | 0.42 | 6.5 | 0.00 | Aug 11, 2026 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service. | ||
| CVE-2026-13060 | Med | 0.42 | 6.5 | 0.00 | Jul 22, 2026 | An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios… | ||
| CVE-2026-13056 | Med | 0.42 | 6.5 | 0.00 | Jul 22, 2026 | Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error. | ||
| CVE-2026-9752 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2026 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that… | ||
| CVE-2026-9750 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2026 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal… | ||
| CVE-2026-9747 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2026 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | ||
| CVE-2026-9743 | Med | 0.42 | 6.5 | 0.00 | Jun 9, 2026 | In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context,… | ||
| CVE-2026-8843 | Med | 0.42 | 6.5 | 0.00 | May 18, 2026 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue… | ||
| CVE-2026-8201 | Med | 0.42 | 6.4 | 0.00 | May 13, 2026 | A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue… | ||
| CVE-2026-8199 | Med | 0.42 | 6.5 | 0.00 | May 13, 2026 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0… | ||
| CVE-2026-8063 | Med | 0.42 | 6.5 | 0.00 | May 7, 2026 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion,… | ||
| CVE-2026-6914 | Med | 0.42 | 6.5 | 0.00 | Apr 29, 2026 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server… | ||
| CVE-2026-25610 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | ||
| CVE-2026-1849 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression. | ||
| CVE-2025-13644 | Med | 0.42 | 6.5 | 0.00 | Nov 25, 2025 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue… | ||
| CVE-2025-13507 | Med | 0.42 | 6.5 | 0.00 | Nov 25, 2025 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16… |
- risk 0.42cvss 6.5epss 0.00
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
- risk 0.42cvss 6.5epss 0.00
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator.…
- risk 0.42cvss 6.5epss 0.00
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service,…
- risk 0.42cvss 6.5epss 0.00
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is…
- risk 0.42cvss 6.5epss 0.00
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.
- risk 0.42cvss 6.5epss 0.00
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios…
- risk 0.42cvss 6.5epss 0.00
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.
- risk 0.42cvss 6.5epss 0.00
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that…
- risk 0.42cvss 6.5epss 0.00
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal…
- risk 0.42cvss 6.5epss 0.00
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.
- risk 0.42cvss 6.5epss 0.00
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context,…
- risk 0.42cvss 6.5epss 0.00
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue…
- risk 0.42cvss 6.4epss 0.00
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue…
- risk 0.42cvss 6.5epss 0.00
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0…
- risk 0.42cvss 6.5epss 0.00
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion,…
- risk 0.42cvss 6.5epss 0.00
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server…
- risk 0.42cvss 6.5epss 0.00
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.
- risk 0.42cvss 6.5epss 0.00
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.
- risk 0.42cvss 6.5epss 0.00
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue…
- risk 0.42cvss 6.5epss 0.00
Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16…
Page 3 of 6