Mongodb Inc vulnerabilities

Products

• Server 41
• Compass 5
• Mongosh 5
• C Driver 4
• Libbson 3
• Php Driver 2
• Rust Driver 2

Newest

• mongodb inc mongosh MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs CVE-2026-115930 7.6 HighOctober 26, 2026
• mongodb compass Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow CVE-2026-14881 8.4 HighJuly 22, 2026
• mongodb c driver Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer CVE-2026-4359 Fix available 2.0 LowMarch 17, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Memory safety issues in slot-based execution hash table spill CVE-2026-4358 Fix available 6.1 MediumMarch 17, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators CVE-2026-4148 Fix available 8.7 HighMarch 17, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Stack memory disclosure in filemd5 command CVE-2026-4147 Fix available 7.1 HighMarch 17, 2026
• mongodb inc go driver Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak CVE-2026-2303 Fix available 6.9 MediumFebruary 10, 2026
• mongodb inc ruby driver Unsafe Reflection in Mongoid::Criteria.from_hash CVE-2026-2302 6.9 MediumFebruary 10, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more An unsafe cast in the MongoDB query planner can result in a segmentation fault. CVE-2026-25613 Fix available 7.1 HighFebruary 10, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Mongod can run out of stack memory when expressions create deeply nested documents CVE-2026-1849 Fix available 7.1 HighFebruary 10, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification CVE-2026-1850 Fix available 7.1 HighFebruary 10, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more profile command may permit unauthorized configuration CVE-2026-25609 Fix available 5.3 MediumFebruary 10, 2026
• mongodb inc server, mongodb, mongodb, inc. mongodb server +2 more Invalid $geoNear index hint may cause server crash CVE-2026-25610 Fix available 7.1 HighFebruary 10, 2026
• mongodb inc server, mongodb, mongodb, inc. mongodb server +2 more Connections received from the proxy port may not count towards total accepted connections CVE-2026-1848 Fix available 8.2 HighFebruary 10, 2026
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server may crash when inserting large documents CVE-2026-1847 Fix available 7.1 HighFebruary 10, 2026
• mongodb inc server, mongodb, inc. mongodb server +1 more Internal ResourceId collision may affect unrelated collections CVE-2026-25612 7.1 HighFebruary 10, 2026
• mongodb inc server, mongodb, inc. mongodb server +1 more Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server CVE-2026-25611 8.7 HighFebruary 10, 2026
• mongodb inc connector for bi MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories CVE-2025-11535 8.8 HighOctober 8, 2025
• mongodb inc server, mongodb, inc. mongodb server +1 more MongoDB Windows installation MSI may leave ACLs unset on custom installation directories CVE-2025-10491 7.8 HighSeptember 15, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Malformed $group Query May Cause MongoDB Server to Crash CVE-2025-10061 Fix available 6.5 MediumSeptember 5, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation CVE-2025-10060 Fix available 6.5 MediumSeptember 5, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server router will crash when incorrect lsid is set on a sharded query CVE-2025-10059 Fix available 6.5 MediumSeptember 5, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash CVE-2025-7259 Fix available 6.5 MediumJuly 7, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections CVE-2025-6714 Fix available 7.5 HighJuly 7, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage CVE-2025-6713 Public exploitFix available 7.7 HighJuly 7, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation CVE-2025-6712 Fix available 6.5 MediumJuly 7, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Incomplete Redaction of Sensitive Information in MongoDB Server Logs CVE-2025-6711 Fix available 4.4 MediumJuly 7, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB CVE-2025-6710 Fix available 7.5 HighJune 26, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication CVE-2025-6709 Fix available 7.5 HighJune 26, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Race condition in privilege cache invalidation cycle CVE-2025-6707 Fix available 4.2 MediumJune 26, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server CVE-2025-6706 Fix available 5.0 MediumJune 26, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked CVE-2025-3085 Fix available 8.1 HighApril 1, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server may crash due to improper validation of explain command CVE-2025-3084 Fix available 6.5 MediumApril 1, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Malformed MongoDB wire protocol messages may cause mongos to crash CVE-2025-3083 Fix available 7.5 HighApril 1, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more User may override a view's collation and gain unauthorized access to underlying data CVE-2025-3082 Fix available 3.1 LowApril 1, 2025
• mongodb libbson, mongodb, mongodb inc server +1 more +3 more MongoDB C Driver bson library may be susceptible to buffer overflow CVE-2025-0755 Fix available 8.4 HighMarch 18, 2025
• mongodb mongosh, redhat codeready linux builder eus, codeready linux builder for arm64 eus +10 more +12 more MongoDB Shell may be susceptible to local privilege escalation in Windows CVE-2025-1756 Fix available 7.5 HighFebruary 27, 2025
• mongodb compass, redhat enterprise linux for arm 64, enterprise linux for ibm z systems +2 more +4 more MongoDB Compass may be susceptible to local privilege escalation in Windows CVE-2025-1755 7.5 HighFebruary 27, 2025
• mongodb mongosh MongoDB Shell may be susceptible to control character Injection via shell output CVE-2025-1693 Fix available 3.9 LowFebruary 27, 2025
• mongodb mongosh MongoDB Shell may be susceptible to control character injection via pasting CVE-2025-1692 Fix available 6.3 MediumFebruary 27, 2025
• mongodb mongosh MongoDB Shell may be susceptible to Control Character Injection via autocomplete CVE-2025-1691 Fix available 7.6 HighFebruary 27, 2025
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server CVE-2024-10921 Fix available 6.8 MediumNovember 14, 2024
• mongodb mongocryptd, mongo crypt v1.so +1 more CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines CVE-2024-8013 2.2 LowOctober 28, 2024
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server secondaries may crash due to forced index constraints CVE-2024-8305 Fix available 6.5 MediumOctober 21, 2024
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server may access non-initialized region of memory leading to unexpected behaviour CVE-2024-8654 Fix available 5.0 MediumSeptember 10, 2024
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths CVE-2024-8207 Fix available 6.4 MediumAugust 27, 2024
• mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server CVE-2024-6384 Fix available 5.3 MediumAugust 13, 2024
• mongodb c driver, mongodb, mongodb php driver +2 more +4 more Accessing Untrusted Directory May Allow Local Privilege Escalation CVE-2024-7553 Fix available 7.3 HighAugust 7, 2024
• mongodb inc libbson MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow CVE-2024-6383 Fix available 5.3 MediumJuly 3, 2024
• mongodb rust driver Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands. CVE-2024-6382 Fix available 6.4 MediumJuly 2, 2024
• Show olderLoading…