MongoDB Server vulnerabilities

Creating a '2dsphere_bucket' index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating 'queryable_encrypted_range' indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6.

CVE-2026-8336 allows an authenticated user to crash the mongod server by improperly using server-side JavaScript functions. The issue affects MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

An authenticated user with aggregation permissions can use a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim to pin CPU utilization at 100% for an extended period. This affects MongoDB Server v7.0 before 7.0.34, v8.0 before 8.0.23, v8.2 before 8.2.9, and v8.3 before 8.3.2.

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering it requires control over the structure of a client's FLE-related query.

When schema validation is enabled on a MongoDB collection and an update or insert violates the collection's schema, the generated local server log message may not have all user data redacted. This affects MongoDB Server v7.0 before 7.0.34, v8.0 before 8.0.23, v8.2 before 8.2.9 and v8.3 before 8.3.2.

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss through OOM. This affects MongoDB Server v7.0 before 7.0.34, v8.0 before 8.0.23, v8.2 before 8.2.9, and v8.3 before 8.3.2.

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog.

An authenticated user can crash mongod by running $rankFusion or $scoreFusion with an empty pipeline on a view. The server reads the first element of the pipeline array without verifying it is non-empty, causing a null pointer dereference and crash.

Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all v8.1 versions, v8.0 versions prior to 8.0.21, and v7.0 versions prior to 7.0.32.

MongoDB Server has a post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions, which may lead to logical data inconsistencies under specific conditions. This can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards, impacting integrity and availability.

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. Affects v7.0 prior to 7.0.26, v8.0 prior to 8.0.13, and v8.1 prior to 8.1.2.

A user with access to the cluster with a limited set of privilege actions may be able to terminate queries being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. The issue affects MongoDB Server v7.0 versions prior to 7.0.26 and v8.0 versions prior to 8.0.14.

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16, and v8.2 versions prior to 8.2.1.

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented EKU requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and v8.2 versions prior to 8.2.2.

An authorized user may crash the MongoDB server by causing a buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. The issue affects MongoDB Server v7.0 versions prior to 7.0.25, v8.0 versions prior to 8.0.15, and version 8.2.0.

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. Affects versions 6.0 before 6.0.25, 7.0 before 7.0.22, and 8.0 before 8.0.12.