MongoDB vulnerabilities
The newest vulnerabilities affecting MongoDB, up to 200. Subscribe by RSS.
- CVE-2026-104005Incorrect authorization in MongoDB Server router for bulk writes to system namespacesMongoDB Server
- CVE-2026-104004Collection validators using collation-accepting expressions can crash MongoDB Server on insertMongoDB Server
- CVE-2026-103965Fixed values in MongoDB Server $bucket stage may be misread as field referencesMongoDB Server
- CVE-2026-96299Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of ServiceMongoDB Server
- CVE-2026-96297MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipelineMongoDB Server
- CVE-2026-89099Race Condition in MongoDB Server Document Value Layer Leads to Memory CorruptionMongoDB Server
- CVE-2026-82076Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB ServerMongoDB Server
- CVE-2026-82075Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of ServiceMongoDB Server
- CVE-2026-82074Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection DataMongoDB Server
- CVE-2026-82073Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas SearchMongoDB Server
- CVE-2026-82071Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds WriteMongoDB Server
- CVE-2026-82070Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting InterfaceMongoDB Server
- CVE-2026-82069Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster RouterMongoDB Server
- CVE-2026-82068Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of ServiceMongoDB Server
- CVE-2026-82067Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupMongoDB Server
- CVE-2026-82066Heap Out-of-Bounds Read in MongoDB Server Query Planning ComponentMongoDB Server
- CVE-2026-82065Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted MetadataMongoDB Server
- CVE-2026-82064Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set MembersMongoDB Server
- CVE-2026-82063Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of ServiceMongoDB Server
- CVE-2026-82062Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate BypassMongoDB Server
- CVE-2026-82061Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of ServiceMongoDB Server
- CVE-2026-82060Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image LookupsMongoDB Server
- CVE-2026-82059Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of ServiceMongoDB Server
- CVE-2026-82058Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of ServiceMongoDB Server
- CVE-2026-82057Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceMongoDB Server
- CVE-2026-82056Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of ServiceMongoDB Server
- CVE-2026-82055Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of ServiceMongoDB Server
- CVE-2026-82054Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of ServiceMongoDB Server
- CVE-2026-82053Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role AssignmentMongoDB Server
- CVE-2026-82052$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 charsMongoDB Server
- CVE-2026-18712Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other CollectionsMongoDB Server
- CVE-2026-18711Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory DisclosureMongoDB Server
- CVE-2026-18709Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data InconsistencyMongoDB Server
- CVE-2026-18698Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate CommandMongoDB Server
- CVE-2026-18690Improper Authorization in MongoDB Server Allows Unauthorized Actions on System CollectionsMongoDB Server
- CVE-2026-18699Improper Input Validation in MongoDB Query Planner Leads to Denial of ServiceMongoDB Server
- CVE-2026-18691Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential ExposureMongoDB Server
- CVE-2026-18702Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic SettingsMongoDB Server
- CVE-2026-18694Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory DisclosureMongoDB Server
- CVE-2026-18708Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query ScopesMongoDB Server
- CVE-2026-18696Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on CollectionsMongoDB Server
- CVE-2026-18700Use-After-Free in MongoDB Geospatial Validation Leads to Denial of ServiceMongoDB Server
- CVE-2026-18701Type Confusion in MongoDB Query Subsystem Leads to Denial of ServiceMongoDB Server
- CVE-2026-18697Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongosMongoDB Server
- CVE-2026-18693Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory DisclosureMongoDB Server
- CVE-2026-18705Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View DataMongoDB Server
- CVE-2026-18704Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write OperationsMongoDB Server
- CVE-2026-18692Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code ExecutionMongoDB Server
- CVE-2026-18688Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory DisclosureMongoDB Server
- CVE-2026-18695Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of ServiceMongoDB Server
- CVE-2026-18687Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index CorruptionMongoDB Server
- CVE-2026-18706Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code ExecutionMongoDB Server
- CVE-2026-18707Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of ServiceMongoDB Server
- CVE-2026-18703Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication MethodMongoDB Server
- CVE-2026-13055Server crash via aggregation pipeline expression with compound wildcard index specificationMongoDB Server
- CVE-2026-13056A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAMMongoDB Server
- CVE-2026-13057Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_METAMongoDB Server
- CVE-2026-13058Transaction Command Insufficient Input Validation Leading to Process TerminationMongoDB Server
- CVE-2026-13059Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassMongoDB Server
- CVE-2026-9737Find command with $meta sort can lead to crashMongoDB Server
- CVE-2026-13060$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection AccessMongoDB Server
- CVE-2026-13061Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation StageMongoDB Server
- CVE-2026-13062MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded ClustersMongoDB Server
- CVE-2026-13063libmongocrypt Improper Input Validation Leading to Process TerminationMongoDB Server
- CVE-2026-13064MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceMongoDB Server
- CVE-2026-13065MongoDB $linearFill Window Function Improper Input Validation Leading to Process TerminationMongoDB Server
- CVE-2026-13066Server-Side JavaScript DBPointer BSON Serialization Memory DisclosureMongoDB Server
- CVE-2026-13067tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain SocketMongoDB Server
- CVE-2026-13068MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege MisuseMongoDB Server
- CVE-2026-13069Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource ExhaustionMongoDB Server
- CVE-2026-13070Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process TerminationMongoDB Server
- CVE-2026-13071Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process TerminationMongoDB Server
- CVE-2026-13072MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionMongoDB Server
- CVE-2026-13073MongoDB Aggregation Command Invariant Assertion Failure Leading to Process TerminationMongoDB Server
- CVE-2026-13074Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceMongoDB Server
- CVE-2026-13075$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationMongoDB Server
- CVE-2026-13076Aggregation Framework Memory Exhaustion Leading to Process TerminationMongoDB Server
- CVE-2026-13077Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataMongoDB Server
- CVE-2026-13078Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module LoaderMongoDB Server
- CVE-2026-11933Post-authentication use-after-free in server-side JavaScript BSON-to-array conversionMongoDB
- CVE-2026-9740Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowMongoDB Server
- CVE-2026-9735Keyfile contents are in MongoDB Server logsMongoDB Server
- CVE-2026-9754Stack memory disclosure in filemd5 commandMongoDB
- CVE-2026-9753Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.MongoDB Server
- CVE-2026-9752GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationMongoDB Server
- CVE-2026-9751Sensitive data could be written to mongod.logMongoDB Server
- CVE-2026-9750Metadata name collision on $-prefixed fields causes post-auth server crashMongoDB Server
- CVE-2026-9749Using MaxKey() may crash the serverMongoDB Server
- CVE-2026-9748$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputMongoDB Server
- CVE-2026-9747Crafted cross-shard merge aggregation crashes MongoDB ServerMongoDB Server
- CVE-2026-9746Server crashes in case of the use of exchangeMongoDB Server
- CVE-2026-9743Aggregation sub-pipeline null dereference may allow DoS via crafted getMoreMongoDB server
- CVE-2026-9742Authenticate command with specific mechanism parameter can trigger server crashMongoDB Server
- CVE-2026-9741Client side encryption fails to encrypt values in a $vectorSearchMongoDB Server
- CVE-2026-8843Calling createIndex with certain index types can crash mongodMongoDB Server
- CVE-2026-8202Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsMongoDB Server
- CVE-2026-8336Post-authentication use-after-free error in $_internalJsEmit and mapreduce commandsMongoDB Server
- CVE-2026-8201Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted FieldsMongoDB Server
- CVE-2026-8200Schema validation log messages may not redact user dataMongoDB Server
- CVE-2026-8199Post-auth memory exhaustion via bitwise match expressionsMongoDB Server
- CVE-2026-8053FlatBSON Duplicate Field Index DriftMongoDB Server
- CVE-2026-8063Post-auth null pointer dereference when aggregating against a view with empty search pipelineMongoDB Server
- CVE-2026-6915Flaw in the updateUser Command May Allow Unauthorized Configuration ChangeMongoDB Server
- CVE-2026-6914MD5 checksum creation may cause availability lossMongoDB Server
- CVE-2026-5170Users could trigger a crash of mongod primaries during promotion to shardedMongoDB Server
- CVE-2026-4358Memory safety issues in slot-based execution hash table spillMongoDB Server
- CVE-2026-4148ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operatorsMongoDB Server
- CVE-2026-4147Stack memory disclosure in filemd5 commandMongoDB Server
- CVE-2026-25613An unsafe cast in the MongoDB query planner can result in a segmentation fault.MongoDB Server
- CVE-2026-1849Mongod can run out of stack memory when expressions create deeply nested documentsMongoDB Server
- CVE-2026-1850An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplificationMongoDB Server
- CVE-2026-25609profile command may permit unauthorized configurationMongoDB Server
- CVE-2026-25610Invalid $geoNear index hint may cause server crashMongoDB Server
- CVE-2026-1848Connections received from the proxy port may not count towards total accepted connectionsMongoDB Server
- CVE-2026-1847MongoDB Server may crash when inserting large documentsMongoDB Server
- CVE-2026-25612Internal ResourceId collision may affect unrelated collectionsMongoDB Server
- CVE-2026-25611Pre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerMongoDB Server
- CVE-2025-14847Zlib compressed protocol header length confusion may allow memory readMongoDB Server
- CVE-2025-14345Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB ServerMongoDB Server
- CVE-2025-13644MongoDB may be susceptible to Invariant Failure due to batched deleteMongoDB Server
- CVE-2025-13643MongoDB Server may allow queries to be terminated by unauthorized usersMongoDB Server
- CVE-2025-12893Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB ServerMongoDB Server
- CVE-2025-13507Time-series operations may cause internal BSON size limit to be exceedMongoDB Server
- CVE-2025-12657Malformed KMIP response may result in access violationMongoDB Server
- CVE-2025-10491MongoDB Windows installation MSI may leave ACLs unset on custom installation directoriesMongoDB Server
- CVE-2025-10061Malformed $group Query May Cause MongoDB Server to CrashMongoDB Server
- CVE-2025-10060MongoDB may be susceptible to Invariant Failure in Transactions due Upsert OperationMongoDB Server
- CVE-2025-10059MongoDB Server router will crash when incorrect lsid is set on a sharded queryMongoDB Server
- CVE-2025-7259Certain Queries with Duplicate _id Fields May Cause MongoDB Server to CrashMongoDB Server
- CVE-2025-6714Incorrect Handling of incomplete data may prevent mongoS from Accepting New ConnectionsMongoDB Server
- CVE-2025-6713MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stageMongoDB Server
- CVE-2025-6712MongoDB Server may be susceptible to DoS due to Accumulated Memory AllocationMongoDB Server
- CVE-2025-6711Incomplete Redaction of Sensitive Information in MongoDB Server LogsMongoDB Server
- CVE-2025-6710Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDBMongoDB Server
- CVE-2025-6709Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC AuthenticationMongoDB Server
- CVE-2025-6707Race condition in privilege cache invalidation cycleMongoDB Server
- CVE-2025-6706Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB ServerMongoDB Server
- CVE-2025-3085MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revokedMongoDB Server
- CVE-2025-3084MongoDB Server may crash due to improper validation of explain commandMongoDB Server
- CVE-2025-3083Malformed MongoDB wire protocol messages may cause mongos to crashMongoDB Server
- CVE-2025-3082User may override a view's collation and gain unauthorized access to underlying dataMongoDB Server
- CVE-2025-0755MongoDB C Driver bson library may be susceptible to buffer overflowMongoDB libbson · MongoDB Server
- CVE-2024-10921Improper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerMongoDB Server
- CVE-2024-8305MongoDB Server secondaries may crash due to forced index constraintsMongoDB Server
- CVE-2024-8654MongoDB Server may access non-initialized region of memory leading to unexpected behaviourMongoDB Server
- CVE-2024-8207MongoDB Server binaries may load potentially insecure shared libraries from specific relative pathsMongoDB Server
- CVE-2024-6384Backup files may be downloaded by underprivileged users in MongoDB Enterprise ServerMongoDB Server
- CVE-2024-7553Accessing Untrusted Directory May Allow Local Privilege EscalationMongoDB Server · MongoDB C Driver +1
- CVE-2024-6375Missing authorization check may lead to shard key refinementMongoDB Server
- CVE-2024-3374MongoDB Server (mongod) may crash when generating ftdcMongoDB Server
- CVE-2024-3372MongoDB Server may have unexpected application behaviour due to invalid BSONMongoDB Server
- CVE-2024-1351MongoDB Server may allow successful untrusted connectionMongoDB Server
- CVE-2023-1409Certificate validation issue in MongoDB Server running on Windows or macOSMongoDB Server
- CVE-2022-24272MongoDB Server (mongod) may crash in response to unexpected requestsMongoDB Server
- CVE-2021-32040Large aggregation pipelines with a specific stage can crash mongod under default configurationMongoDB Server
- CVE-2021-32036Denial of Service and Data Integrity vulnerability in features commandMongoDB Server
- CVE-2021-20330Specific replication command with malformed oplog entries can crash secondariesMongoDB Server
- CVE-2021-32037User may trigger invariant when allowed to send commands directly to shardsMongoDB Server
- CVE-2021-20333Server log entry spoofing via newline injectionMongoDB Server
- CVE-2021-20326Specially crafted query may result in a denial of service of mongodMongoDB Server
- CVE-2018-25004Invariant failure when explaining a find with a UUIDMongoDB Server
- CVE-2020-7929Specially crafted regex query can cause DoSMongoDB Server
- CVE-2019-20925Denial of service via malformed network packetMongoDB Server
- CVE-2018-20803Infinite loop in aggregation expressionMongoDB Server
- CVE-2020-7928Improper neutralization of null byte leads to read overrunMongoDB Server
- CVE-2019-2393Crash while joining collections with $lookupMongoDB Server
- CVE-2019-20923Crash while handling internal Javascript exception typesMongoDB Server
- CVE-2019-20924Invariant in IndexBoundsBuilderMongoDB Server
- CVE-2019-2392$mod can result in undefined behaviorMongoDB Server
- CVE-2018-20805Invariant with $elemMatchMongoDB Server
- CVE-2018-20802Post-auth queries on compound index may crash mongodMongoDB Server
- CVE-2018-20804Invariant failure in applyOpsMongoDB Server
- CVE-2020-7926Specific query can cause a DoS against MongoDB ServerMongoDB Server
- CVE-2020-7925Denial of Service when processing malformed Role namesMongoDB Server
- CVE-2020-7923Specific GeoQuery can cause DoS against MongoDB ServerMongoDB Server
- CVE-2020-7921Administrative action may disable enforcement of per-user IP whitelistingMongoDB Server
- CVE-2019-2389Process termination via PID file manipulationMongoDB Server
- CVE-2019-2390Code execution on Windows via OpenSSL engine injectionMongoDB Server
- CVE-2019-2386Authorization session conflationMongoDB Server