MongoDB
by MongoDB
Source repositories
CVEs (149)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-8063 | Med | 0.42 | 6.5 | 0.00 | May 7, 2026 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion,… | ||
| CVE-2026-6914 | Med | 0.42 | 6.5 | 0.00 | Apr 29, 2026 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server… | ||
| CVE-2026-4358 | Med | 0.42 | 6.4 | 0.00 | Mar 17, 2026 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk. | ||
| CVE-2026-4147 | Med | 0.42 | 6.5 | 0.00 | Mar 17, 2026 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. | ||
| CVE-2026-25613 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. | ||
| CVE-2026-25610 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | ||
| CVE-2026-1850 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. | ||
| CVE-2026-1849 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression. | ||
| CVE-2026-1847 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash. | ||
| CVE-2026-25612 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks. | ||
| CVE-2025-14911 | Med | 0.42 | 6.5 | 0.00 | Jan 27, 2026 | User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container. | ||
| CVE-2025-13644 | Med | 0.42 | 6.5 | 0.00 | Nov 25, 2025 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue… | ||
| CVE-2025-13507 | Med | 0.42 | 6.5 | 0.00 | Nov 25, 2025 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16… | ||
| CVE-2025-10061 | Med | 0.42 | 6.5 | 0.00 | Sep 5, 2025 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability… | ||
| CVE-2025-10060 | Med | 0.42 | 6.5 | 0.00 | Sep 5, 2025 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects… | ||
| CVE-2025-10059 | Med | 0.42 | 6.5 | 0.00 | Sep 5, 2025 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0… | ||
| CVE-2025-7259 | Med | 0.42 | 6.5 | 0.00 | Jul 7, 2025 | An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0. | ||
| CVE-2025-6712 | Med | 0.42 | 6.5 | 0.00 | Jul 7, 2025 | MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than… | ||
| CVE-2025-3084 | Med | 0.42 | 6.5 | 0.00 | Apr 1, 2025 | When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16… | ||
| CVE-2024-8305 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2024 | prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB… |
- risk 0.42cvss 6.5epss 0.00
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion,…
- risk 0.42cvss 6.5epss 0.00
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server…
- risk 0.42cvss 6.4epss 0.00
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
- risk 0.42cvss 6.5epss 0.00
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
- risk 0.42cvss 6.5epss 0.00
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.
- risk 0.42cvss 6.5epss 0.00
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.
- risk 0.42cvss 6.5epss 0.00
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.
- risk 0.42cvss 6.5epss 0.00
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.
- risk 0.42cvss 6.5epss 0.00
Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.
- risk 0.42cvss 6.5epss 0.00
The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.
- risk 0.42cvss 6.5epss 0.00
User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.
- risk 0.42cvss 6.5epss 0.00
MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue…
- risk 0.42cvss 6.5epss 0.00
Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16…
- risk 0.42cvss 6.5epss 0.00
An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability…
- risk 0.42cvss 6.5epss 0.00
MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects…
- risk 0.42cvss 6.5epss 0.00
An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0…
- risk 0.42cvss 6.5epss 0.00
An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.
- risk 0.42cvss 6.5epss 0.00
MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than…
- risk 0.42cvss 6.5epss 0.00
When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16…
- risk 0.42cvss 6.5epss 0.01
prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB…
Page 4 of 8