Mongodb Server

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

Published: 2026-03-17T19:00:07.518Z
Updated: 2026-03-17T20:08:24.920Z

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

Published: 2026-03-17T15:53:57.874Z
Updated: 2026-03-18T03:55:44.426Z

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

Published: 2026-03-17T15:50:21.888Z
Updated: 2026-03-17T16:09:55.480Z

An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

Published: 2026-02-10T18:54:50.376Z
Updated: 2026-02-10T19:15:20.731Z

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.

Published: 2026-02-10T18:05:23.851Z
Updated: 2026-02-10T18:59:27.442Z

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

Published: 2026-02-10T17:52:47.181Z
Updated: 2026-02-11T15:21:16.207Z

An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.

Published: 2026-02-10T18:30:40.756Z
Updated: 2026-02-10T20:29:51.688Z

Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

Published: 2026-02-10T18:39:11.201Z
Updated: 2026-02-10T19:52:07.572Z

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

Published: 2026-02-10T18:49:32.084Z
Updated: 2026-02-10T19:18:26.224Z

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

Published: 2026-02-10T18:52:52.737Z
Updated: 2026-02-10T19:17:02.296Z

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

Published: 2026-02-10T18:22:41.971Z
Updated: 2026-02-11T15:17:01.970Z

Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.

Published: 2026-02-10T18:16:24.739Z
Updated: 2026-02-10T20:12:18.968Z

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5

Published: 2025-09-15T16:04:54.221Z
Updated: 2026-02-26T17:48:37.469Z

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2

Published: 2025-09-05T20:48:25.215Z
Updated: 2025-09-05T21:08:44.186Z

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12

Published: 2025-09-05T20:39:14.188Z
Updated: 2025-09-05T21:08:05.687Z

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

Published: 2025-09-05T20:26:52.612Z
Updated: 2025-09-05T20:44:22.665Z

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16

Published: 2025-03-18T09:01:04.793Z
Updated: 2025-11-03T19:35:09.738Z

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

Published: 2024-03-07T16:10:19.597Z
Updated: 2025-02-13T17:27:37.200Z

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

Published: 2023-08-23T15:21:43.150Z
Updated: 2025-02-13T16:39:22.593Z