Mongodb Mongodb Server
16 CVEs affecting Mongodb Mongodb Server. Latest disclosed: 2026-06-09. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9753 | High | 8.1 | 2026-06-09 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bou… |
CVE-2026-9742 | High | 7.5 | 2026-06-09 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to s… |
CVE-2026-9740 | High | 7.5 | 2026-06-09 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. Th… |
CVE-2026-9752 | Medium | 6.5 | 2026-06-09 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polyg… |
CVE-2026-9750 | Medium | 6.5 | 2026-06-09 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing du… |
CVE-2026-9749 | Medium | 6.5 | 2026-06-09 | This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving de… |
CVE-2026-9748 | Medium | 6.5 | 2026-06-09 | The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecuti… |
CVE-2026-9747 | Medium | 6.5 | 2026-06-09 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. |
CVE-2026-9746 | Medium | 6.5 | 2026-06-09 | When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are… |
CVE-2026-9743 | Medium | 6.5 | 2026-06-09 | In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued o… |
CVE-2026-9741 | Medium | 6.5 | 2026-06-09 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results… |
CVE-2026-6914 | Medium | 6.5 | 2026-04-29 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoD… |
CVE-2026-6915 | Medium | 6.3 | 2026-04-29 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with a… |
CVE-2026-9751 | Medium | 5.5 | 2026-06-09 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. |
CVE-2026-9735 | Medium | 5.5 | 2026-06-09 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is… |
CVE-2026-5170 | Medium | 5.3 | 2026-03-30 | A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window w… |