MongoDB Inc
61 CVEs across 18 MongoDB Inc products. Browse MongoDB Inc vulnerabilities, severities, and proof-of-concept exploits.
MongoDB Inc products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4359 | Low | 2.0 | 2026-03-17 | A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C… |
CVE-2026-4358 | Medium | 6.4 | 2026-03-17 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the… |
CVE-2026-4148 | High | 8.8 | 2026-03-17 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $grap… |
CVE-2026-4147 | Medium | 6.5 | 2026-03-17 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. |
CVE-2026-2303 | Medium | 6.5 | 2026-02-10 | The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-… |
CVE-2026-2302 | Medium | 6.5 | 2026-02-10 | Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code. |
CVE-2026-25613 | Medium | 6.5 | 2026-02-10 | An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. |
CVE-2026-25610 | Medium | 6.5 | 2026-02-10 | An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. |
CVE-2026-25609 | Medium | 5.4 | 2026-02-10 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. |
CVE-2026-1850 | Medium | 6.5 | 2026-02-10 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. |
CVE-2026-1849 | Medium | 6.5 | 2026-02-10 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functio… |
CVE-2026-1848 | High | 7.5 | 2026-02-10 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections excee… |
CVE-2026-1847 | Medium | 6.5 | 2026-02-10 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall… |
CVE-2026-25612 | Medium | 6.5 | 2026-02-10 | The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadverte… |
CVE-2026-25611 | High | 7.5 | 2026-02-10 | A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server. |
CVE-2025-11535 | | 2025-10-08 | MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB… | |
CVE-2025-10491 | High | 7.8 | 2025-09-15 | The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB'… |
CVE-2025-10061 | Medium | 6.5 | 2025-09-05 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of… |
CVE-2025-10060 | Medium | 6.5 | 2025-09-05 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and serve… |
CVE-2025-10059 | Medium | 6.5 | 2025-09-05 | An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided i… |
CVE-2025-7259 | Medium | 6.5 | 2025-07-07 | An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can… |
CVE-2025-6714 | High | 7.5 | 2025-07-07 | MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured… |
CVE-2025-6713 | High | 7.7 | 2025-07-07 | An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCu… |
CVE-2025-6712 | Medium | 6.5 | 2025-07-07 | MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in… |
CVE-2025-6711 | Medium | 4.4 | 2025-07-07 | An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered… |
CVE-2025-6710 | High | 7.5 | 2025-06-26 | MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recu… |
CVE-2025-6709 | High | 7.5 | 2025-06-26 | The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentic… |
CVE-2025-6707 | Medium | 4.2 | 2025-06-26 | Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This… |
CVE-2025-6706 | Medium | 5.0 | 2025-06-26 | An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have author… |
CVE-2025-3085 | High | 8.1 | 2025-04-01 | A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the in… |
CVE-2025-3084 | Medium | 6.5 | 2025-04-01 | When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. Th… |
CVE-2025-3083 | High | 7.5 | 2025-04-01 | Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connecti… |
CVE-2025-3082 | Low | 3.1 | 2025-04-01 | A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. T… |
CVE-2025-0755 | High | 8.4 | 2025-03-18 | The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final… |
CVE-2025-1756 | High | 7.5 | 2025-02-27 | mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated pr… |
CVE-2025-1755 | High | 7.5 | 2025-02-27 | MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with ele… |
CVE-2025-1693 | Low | 3.9 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control charac… |
CVE-2025-1692 | Medium | 6.3 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text… |
CVE-2025-1691 | High | 7.6 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocomplet… |
CVE-2024-10921 | Medium | 6.8 | 2024-11-14 | An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malfo… |
CVE-2024-8013 | Low | 2.2 | 2024-10-28 | A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to… |
CVE-2024-8305 | Medium | 6.5 | 2024-10-21 | prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple… |
CVE-2024-8654 | Medium | 5.0 | 2024-09-10 | MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This i… |
CVE-2024-8207 | Medium | 6.4 | 2024-08-27 | In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a uninte… |
CVE-2024-6384 | Medium | 5.3 | 2024-08-13 | "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterpri… |
CVE-2024-7553 | High | 7.3 | 2024-08-07 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This… |
CVE-2024-6383 | Medium | 5.3 | 2024-07-03 | The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and… |
CVE-2024-6382 | Medium | 6.4 | 2024-07-02 | Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application be… |
CVE-2024-6381 | Medium | 4.0 | 2024-07-02 | The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative o… |
CVE-2024-6376 | High | 7.0 | 2024-07-01 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectio… |
CVE-2024-6375 | Medium | 5.4 | 2024-07-01 | A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degra… |
CVE-2024-5629 | Medium | 4.7 | 2024-06-05 | An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception whic… |
CVE-2024-3374 | Medium | 5.3 | 2024-05-14 | An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exce… |
CVE-2024-3372 | High | 7.5 | 2024-05-14 | Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause u… |
CVE-2024-3371 | High | 7.1 | 2024-04-24 | MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including… |
CVE-2024-1351 | High | 8.8 | 2024-03-07 | Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to su… |
CVE-2023-0437 | Medium | 5.3 | 2024-01-12 | When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All Mo… |
CVE-2023-0436 | Medium | 4.5 | 2023-11-07 | The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBU… |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2023-1409 | Medium | 5.3 | 2023-08-23 | If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely… |
CVE-2022-48282 | Medium | 6.6 | 2023-02-21 | Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause… |