MongoDB Inc Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with MongoDB Server.

Products

Clear product

Showing 25 vulnerabilities on this page for MongoDB Server

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Memory safety issues in slot-based execution hash table spill

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

CWE-415Mar 17, 2026
CVSS6.1v4.0EPSS0.342%PoCs0SignalsSTIX

ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

CWE-416Mar 17, 2026
CVSS8.7v4.0EPSS0.323%PoCs0SignalsSTIX

Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

CWE-457CWE-908Mar 17, 2026
CVSS7.1v4.0EPSS0.215%PoCs0SignalsSTIX

An unsafe cast in the MongoDB query planner can result in a segmentation fault.

An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

CWE-704Feb 10, 2026
CVSS7.1v4.0EPSS0.24%PoCs0SignalsSTIX

Mongod can run out of stack memory when expressions create deeply nested documents

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

CWE-674Feb 10, 2026
CVSS7.1v4.0EPSS0.272%PoCs0SignalsSTIX

An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

CWE-770Feb 10, 2026
CVSS7.1v4.0EPSS0.243%PoCs0SignalsSTIX

profile command may permit unauthorized configuration

Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

CWE-862Feb 10, 2026
CVSS5.3v4.0EPSS0.173%PoCs0SignalsSTIX

Invalid $geoNear index hint may cause server crash

An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.

CWE-617Feb 10, 2026
CVSS7.1v4.0EPSS0.24%PoCs0SignalsSTIX

Connections received from the proxy port may not count towards total accepted connections

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

CWE-770Feb 10, 2026
CVSS8.2v4.0EPSS0.263%PoCs0SignalsSTIX

MongoDB Server may crash when inserting large documents

Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.

CWE-770Feb 10, 2026
CVSS7.1v4.0EPSS0.243%PoCs0SignalsSTIX

Internal ResourceId collision may affect unrelated collections

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.

CWE-412Feb 10, 2026
CVSS7.1v4.0EPSS0.199%PoCs0SignalsSTIX

Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

CWE-405Feb 10, 2026
CVSS8.7v4.0EPSS0.782%PoCs0SignalsSTIX

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5

CWE-284Sep 15, 2025
CVSS7.8v3.1EPSS0.111%PoCs0SignalsSTIX

Malformed $group Query May Cause MongoDB Server to Crash

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and Mong…

CWE-20Sep 5, 2025
CVSS6.5v3.1EPSS0.31%PoCs0SignalsSTIX

MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12

CWE-672Sep 5, 2025
CVSS6.5v3.1EPSS0.327%PoCs0SignalsSTIX

MongoDB Server router will crash when incorrect lsid is set on a sharded query

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

CWE-732Sep 5, 2025
CVSS6.5v3.1EPSS0.272%PoCs0SignalsSTIX

Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash

An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

CWE-843Jul 7, 2025
CVSS6.5v3.1EPSS0.282%PoCs0SignalsSTIX

Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections

MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9 Required Configuration: This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.

CWE-400CWE-834Jul 7, 2025
CVSS7.5v3.1EPSS0.307%PoCs0SignalsSTIX

MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22

CWE-285Jul 7, 2025
CVSS7.7v3.1EPSS0.343%PoCs1SignalsSTIX

MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation

MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10

CWE-400Jul 7, 2025
CVSS6.5v3.1EPSS0.282%PoCs0SignalsSTIX

Incomplete Redaction of Sensitive Information in MongoDB Server Logs

An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.

CWE-532Jul 7, 2025
CVSS4.4v3.1EPSS0.239%PoCs0SignalsSTIX

Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB

MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6…

CWE-674Jun 26, 2025
CVSS7.5v3.1EPSS0.307%PoCs0SignalsSTIX

Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication

The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can onl…

CWE-20Jun 26, 2025
CVSS7.5v3.1EPSS0.489%PoCs0SignalsSTIX

Race condition in privilege cache invalidation cycle

Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.

CWE-863Jun 26, 2025
CVSS4.2v3.1EPSS0.147%PoCs0SignalsSTIX

Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version pr…

CWE-416Jun 26, 2025
CVSS5.0v3.1EPSS0.219%PoCs0SignalsSTIX