What is CVE-2026-9737?

CVE-2026-9737 is a medium-severity vulnerability in Mongodb Server, classified under Reachable Assertion. CVSS score: 6.5/10. Published 2026-07-22.

How severe is CVE-2026-9737?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Mongodb Server

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mongodb Server — versions 7.0, 8.0, 8.2.0

Weakness classification (CWE)

CWE-617 — Reachable Assertion

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-9737?: CVE-2026-9737 is a medium-severity vulnerability in Mongodb Server, classified under Reachable Assertion. CVSS score: 6.5/10. Published 2026-07-22.
How severe is CVE-2026-9737?: Medium severity. CVSS v3 base score is 6.5 out of 10.