Mongodb vulnerabilities
332 vulnerabilities
Known vulnerabilities in Mongodb products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 52 products.
Products
47 of 52- Mongodb187 vulnerabilities
- Mongodb Server95 vulnerabilities
- C Driver37 vulnerabilities
- Php Driver9 vulnerabilities
- Bi Connector8 vulnerabilities
- Bi Connector Odbc Driver8 vulnerabilities
- Mongoid8 vulnerabilities
- Compass7 vulnerabilities
- Ops Manager7 vulnerabilities
- Libmongocrypt6 vulnerabilities
- Go Driver5 vulnerabilities
- Python Driver5 vulnerabilities
- Rust Driver5 vulnerabilities
- Java Driver4 vulnerabilities
- Laravel Mongodb (Php)4 vulnerabilities
- Mongosh4 vulnerabilities
- BI Connector Transition Readiness Report3 vulnerabilities
- Entity Framework Core Provider3 vulnerabilities
- Laravel Mongodb3 vulnerabilities
- Libbson3 vulnerabilities
- Mongosql Transition Readiness Tool3 vulnerabilities
- Atlas SQL ODBC Driver2 vulnerabilities
- Bson2 vulnerabilities
- Js Bson2 vulnerabilities
- Ops Manager Server2 vulnerabilities
- Php Library2 vulnerabilities
- Schema Builder CLI2 vulnerabilities
- Sql Schema Builder Cli2 vulnerabilities
- Atlas Kubernetes Operator1 vulnerabilities
- C\+\+1 vulnerabilities
- Database Tools1 vulnerabilities
- Mongo Crypt V1.So1 vulnerabilities
- Mongo C Driver1 vulnerabilities
- Mongocryptd1 vulnerabilities
- Mongodb Client Encryption1 vulnerabilities
- Mongodb Compass1 vulnerabilities
- Mongodb Driver1 vulnerabilities
- Mongodb Enterprise Kubernetes Operator1 vulnerabilities
- Mongodb For VS Code1 vulnerabilities
- Mongodb PHP Library1 vulnerabilities
- Mongomirror1 vulnerabilities
- Node.Js1 vulnerabilities
- Odbc Driver1 vulnerabilities
- PHP Extension1 vulnerabilities
- Pymongo1 vulnerabilities
- Ruby Driver1 vulnerabilities
- Swift Driver1 vulnerabilities
CVE-2026-96299ubuntumongodb+1
EPSS score0.24%
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.CVE-2026-96297ubuntumongodb+1EPSS score0.22%
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.CVE-2026-103965ubuntumongodb+1EPSS score0.15%
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.CVE-2026-104005ubuntumongodb+1EPSS score0.24%
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.CVE-2026-104004ubuntumongodb+1EPSS score0.24%
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.CVE-2018-16790debianlibbson-xs-perl+3EPSS score2.13%
_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.CVE-2018-13863debiannode-mongodb+3EPSS score1.94%
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.CVE-2018-20805ubuntumongodb+2EPSS score1.25%
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.CVE-2018-20802ubuntumongodb+2EPSS score1.58%
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.CVE-2018-20804ubuntumongodb+2EPSS score1.25%
A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.CVE-2018-20803ubuntumongodb+2EPSS score1.44%
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.CVE-2018-25004ubuntumongodb+2EPSS score1.00%
A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.CVE-2013-2132canonicalubuntu_linux+5EPSS score4.11%
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."CVE-2013-1892mongodbmongodb+1EPSS score44.54%
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.CVE-2013-4650ubuntumongodb+1EPSS score1.65%
MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.CVE-2013-3969mongodbmongodbEPSS score10.11%
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.CVE-2021-20328ubuntumongo-java-driver+10EPSS score0.44%
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.CVE-2021-20331mongodb incmongodb c driver+2EPSS score0.62%
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.CVE-2021-20334mongodb incmongodb compass+1EPSS score0.20%
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.CVE-2021-20333ubuntumongodb+2EPSS score1.30%
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.10.