MongoDB Inc. MongoDB Server
41 CVEs affecting MongoDB Inc. MongoDB Server. Latest disclosed: 2026-05-18. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8053 | High | 8.8 | 2026-05-13 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memo… |
CVE-2019-2390 | High | 8.2 | 2019-08-30 | An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with M… |
CVE-2026-8336 | High | 7.5 | 2026-05-13 | After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user c… |
CVE-2025-14847 | High | 7.5 | 2025-12-19 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all… |
CVE-2019-20925 | High | 7.5 | 2020-11-24 | An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectl… |
CVE-2020-7925 | High | 7.5 | 2020-11-23 | Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially craf… |
CVE-2019-2386 | High | 7.1 | 2019-08-06 | After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflate… |
CVE-2026-8843 | Medium | 6.5 | 2026-05-18 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating… |
CVE-2026-8199 | Medium | 6.5 | 2026-05-13 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear… |
CVE-2026-8063 | Medium | 6.5 | 2026-05-07 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects t… |
CVE-2025-13644 | Medium | 6.5 | 2025-11-25 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assume… |
CVE-2025-13507 | Medium | 6.5 | 2025-11-25 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and… |
CVE-2022-24272 | Medium | 6.5 | 2022-04-21 | An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mong… |
CVE-2021-32040 | Medium | 6.5 | 2022-04-12 | It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of t… |
CVE-2021-20330 | Medium | 6.5 | 2021-12-15 | An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potentia… |
CVE-2021-32037 | Medium | 6.5 | 2021-11-24 | An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually… |
CVE-2021-20326 | Medium | 6.5 | 2021-04-30 | A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4. |
CVE-2020-7929 | Medium | 6.5 | 2021-03-01 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong… |
CVE-2018-20803 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics proces… |
CVE-2020-7928 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects M… |