Mongodb Inc. Mongodb Server vulnerabilities, page 4
82 vulnerabilities
Known vulnerabilities in Mongodb Inc. Mongodb Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2019-20923ubuntumongodb+2
EPSS score1.27%
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.CVE-2026-1847ubuntumongodb+2EPSS score0.28%
Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.CVE-2026-1849ubuntumongodb+2EPSS score0.32%
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.CVE-2026-1850ubuntumongodb+2EPSS score0.28%
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.CVE-2026-1848ubuntumongodb+2EPSS score0.30%
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.CVE-2026-4358ubuntumongodb+2EPSS score0.38%
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.CVE-2026-4147ubuntumongodb+2EPSS score0.38%
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.CVE-2026-4148ubuntumongodb+2EPSS score0.57%
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.CVE-2026-25611ubuntumongodb+1EPSS score0.71%
A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.CVE-2026-25613ubuntumongodb+2EPSS score0.49%
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.CVE-2026-25610ubuntumongodb+2EPSS score0.49%
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.CVE-2026-25612ubuntumongodb+1EPSS score0.38%
The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.CVE-2026-25609ubuntumongodb+2EPSS score0.34%
Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-8843ubuntumongodb+2EPSS score0.42%
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6CVE-2026-8202ubuntumongodb+2EPSS score0.45%
Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.CVE-2026-8200ubuntumongodb+2EPSS score0.34%
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.CVE-2026-8336ubuntumongodb+2EPSS score0.47%
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.
This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.CVE-2026-8053ubuntumongodb+2EPSS score0.66%
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.
This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.CVE-2026-8201ubuntumongodb+2EPSS score0.22%
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.
This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.CVE-2026-8063ubuntumongodb+2EPSS score0.39%
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.
When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stage’s input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server.
This issue affects MongoDB Server 8.2 versions prior to 8.2.7.