MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-4147Stack memory disclosure in filemd5 command
- CVE-2026-2303Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
- CVE-2026-2302Unsafe Reflection in Mongoid::Criteria.from_hash
- CVE-2026-25613An unsafe cast in the MongoDB query planner can result in a segmentation fault.
- CVE-2026-1849Mongod can run out of stack memory when expressions create deeply nested documents
- CVE-2026-1850An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification
- CVE-2026-25609profile command may permit unauthorized configuration
- CVE-2026-25610Invalid $geoNear index hint may cause server crash
- CVE-2026-1848Connections received from the proxy port may not count towards total accepted connections
- CVE-2026-1847MongoDB Server may crash when inserting large documents
- CVE-2026-25612Internal ResourceId collision may affect unrelated collections
- CVE-2026-25611Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
- CVE-2025-14911Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure
- CVE-2025-14847Zlib compressed protocol header length confusion may allow memory read
- CVE-2025-14345Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
- CVE-2025-13644MongoDB may be susceptible to Invariant Failure due to batched delete
- CVE-2025-13643MongoDB Server may allow queries to be terminated by unauthorized users
- CVE-2025-12893Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server
- CVE-2025-13507Time-series operations may cause internal BSON size limit to be exceed
- CVE-2025-12119Bulk write with options may read invalid memory
- CVE-2025-12657Malformed KMIP response may result in access violation
- CVE-2025-12100MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories
- CVE-2025-11575MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories
- CVE-2025-11979Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior
- CVE-2025-11695Configuration may unexpectedly disable certificate validation
- CVE-2025-11535MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories
- CVE-2025-10491MongoDB Windows installation MSI may leave ACLs unset on custom installation directories
- CVE-2025-10061Malformed $group Query May Cause MongoDB Server to Crash
- CVE-2025-10060MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation
- CVE-2025-10059MongoDB Server router will crash when incorrect lsid is set on a sharded query