MongoDB Inc.
63 CVEs across 24 MongoDB Inc. products. Browse MongoDB Inc. vulnerabilities, severities, and proof-of-concept exploits.
MongoDB Inc. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9101 | Medium | 4.3 | 2026-05-20 | Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user beh… |
CVE-2026-9100 | Medium | 5.9 | 2026-05-20 | The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collectio… |
CVE-2026-8843 | Medium | 6.5 | 2026-05-18 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating… |
CVE-2026-6811 | Medium | 5.9 | 2026-05-14 | Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances wh… |
CVE-2026-8336 | High | 7.5 | 2026-05-13 | After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user c… |
CVE-2026-8202 | Medium | 4.3 | 2026-05-13 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggreg… |
CVE-2026-8201 | Medium | 6.4 | 2026-05-13 | A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_s… |
CVE-2026-8200 | Low | 2.7 | 2026-05-13 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not… |
CVE-2026-8199 | Medium | 6.5 | 2026-05-13 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear… |
CVE-2026-8053 | High | 8.8 | 2026-05-13 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memo… |
CVE-2026-8431 | High | 7.2 | 2026-05-12 | An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMar… |
CVE-2026-8063 | Medium | 6.5 | 2026-05-07 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects t… |
CVE-2026-6691 | High | 7.8 | 2026-05-06 | The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authe… |
CVE-2026-6231 | Medium | 4.3 | 2026-04-13 | The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data… |
CVE-2025-14847 | High | 7.5 | 2025-12-19 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all… |
CVE-2025-14345 | Medium | 4.2 | 2025-12-09 | A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencie… |
CVE-2025-13644 | Medium | 6.5 | 2025-11-25 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assume… |
CVE-2025-13643 | Low | 3.1 | 2025-11-25 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cau… |
CVE-2025-13507 | Medium | 6.5 | 2025-11-25 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and… |
CVE-2025-12893 | Medium | 4.2 | 2025-11-25 | Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Us… |
CVE-2025-12657 | Medium | 5.0 | 2025-11-03 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of thi… |
CVE-2025-11979 | Medium | 5.3 | 2025-10-20 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under… |
CVE-2023-4009 | High | 7.2 | 2023-08-08 | In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access t… |
CVE-2023-0342 | Low | 3.1 | 2023-06-09 | MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This iss… |
CVE-2022-24272 | Medium | 6.5 | 2022-04-21 | An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mong… |
CVE-2021-32040 | Medium | 6.5 | 2022-04-12 | It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of t… |
CVE-2021-32036 | Medium | 5.4 | 2022-02-04 | An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource dep… |
CVE-2021-32039 | Medium | 5.5 | 2022-01-20 | Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credential… |
CVE-2021-20330 | Medium | 6.5 | 2021-12-15 | An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potentia… |
CVE-2021-32037 | Medium | 6.5 | 2021-11-24 | An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually… |
CVE-2021-20332 | Medium | 4.2 | 2021-08-02 | Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted w… |
CVE-2021-20333 | Medium | 5.3 | 2021-07-23 | Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects… |
CVE-2021-20329 | Medium | 6.8 | 2021-06-10 | Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object wi… |
CVE-2021-20331 | Medium | 4.2 | 2021-05-13 | Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an applica… |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2020-7924 | Medium | 4.2 | 2021-04-12 | Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certif… |
CVE-2021-20334 | Medium | 4.8 | 2021-04-06 | A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the use… |
CVE-2018-25004 | Medium | 4.9 | 2021-03-01 | A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affec… |
CVE-2020-7929 | Medium | 6.5 | 2021-03-01 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong… |
CVE-2021-20328 | Medium | 6.4 | 2021-02-25 | Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s… |
CVE-2021-20327 | Medium | 6.4 | 2021-02-25 | A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in c… |
CVE-2021-20335 | Medium | 6.7 | 2021-02-11 | For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the u… |
CVE-2019-20925 | High | 7.5 | 2020-11-24 | An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectl… |
CVE-2020-7927 | High | 8.1 | 2020-11-23 | Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue… |
CVE-2018-20803 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics proces… |
CVE-2020-7928 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects M… |
CVE-2019-2393 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue… |
CVE-2019-2392 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negat… |
CVE-2019-20924 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsB… |
CVE-2019-20923 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions c… |
CVE-2018-20805 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affe… |
CVE-2018-20804 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Serve… |
CVE-2018-20802 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner… |
CVE-2020-7926 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server select… |
CVE-2020-7925 | High | 7.5 | 2020-11-23 | Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially craf… |
CVE-2020-7923 | Medium | 6.5 | 2020-08-21 | A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsyst… |
CVE-2019-2388 | Medium | 5.8 | 2020-05-13 | In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager in… |
CVE-2020-7921 | Medium | 4.6 | 2020-05-06 | Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to by… |
CVE-2020-7922 | Medium | 6.4 | 2020-04-09 | X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to Mongo… |
CVE-2019-2391 | Medium | 4.2 | 2020-03-31 | Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data di… |
CVE-2019-2390 | High | 8.2 | 2019-08-30 | An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with M… |
CVE-2019-2389 | Medium | 5.3 | 2019-08-30 | Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to b… |
CVE-2019-2386 | High | 7.1 | 2019-08-06 | After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflate… |