CVE-2026-9752

MEDIUM

GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

Title source: cna

Description

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.

References (1)

Core 1

Core References

https://jira.mongodb.org/browse/SERVER-123440

Scores

CVSS v3 6.5

EPSS 0.0024

EPSS Percentile 14.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-476

Status published

Products (4)

MongoDB/MongoDB Server 7.0.0 - 7.0.35

MongoDB/MongoDB Server 8.0.0 - 8.0.24

MongoDB/MongoDB Server 8.2.0 - 8.2.10

MongoDB/MongoDB Server 8.3.0 - 8.3.3

Published Jun 09, 2026

Tracked Since Jun 10, 2026