Mongodb Inc. Server vulnerabilities

• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Post-auth null pointer dereference when aggregating against a view with empty search pipeline CVE-2026-8063 Fix available 7.1 HighMay 7, 2026
• mongodb, mongodb and mongodb server, mongodb inc. server +1 more +3 more Zlib compressed protocol header length confusion may allow memory read CVE-2025-14847 In KEVPublic exploitFix available EPSS 83.2% 8.7 HighDecember 19, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server CVE-2025-14345 Fix available 2.3 LowDecember 9, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more MongoDB may be susceptible to Invariant Failure due to batched delete CVE-2025-13644 Fix available 7.1 HighNovember 25, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more MongoDB Server may allow queries to be terminated by unauthorized users CVE-2025-13643 Fix available 2.3 LowNovember 25, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server CVE-2025-12893 Fix available 2.3 LowNovember 25, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Time-series operations may cause internal BSON size limit to be exceed CVE-2025-13507 Fix available 7.1 HighNovember 25, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Malformed KMIP response may result in access violation CVE-2025-12657 Fix available 5.9 MediumNovember 3, 2025
• devolutions server, mongodb +1 more Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior CVE-2025-11979 Fix available 5.3 MediumOctober 20, 2025
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more MongoDB Server (mongod) may crash in response to unexpected requests CVE-2022-24272 Fix available 6.5 MediumApril 21, 2022
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Large aggregation pipelines with a specific stage can crash mongod under default configuration CVE-2021-32040 Fix available 6.5 MediumApril 12, 2022
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Denial of Service and Data Integrity vulnerability in features command CVE-2021-32036 Fix available 5.4 MediumFebruary 4, 2022
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Specific replication command with malformed oplog entries can crash secondaries CVE-2021-20330 Fix available 6.5 MediumDecember 15, 2021
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more User may trigger invariant when allowed to send commands directly to shards CVE-2021-32037 Fix available 6.5 MediumNovember 24, 2021
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Server log entry spoofing via newline injection CVE-2021-20333 Fix available 5.3 MediumJuly 23, 2021
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Specially crafted query may result in a denial of service of mongod CVE-2021-20326 Fix available 6.5 MediumApril 30, 2021
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Invariant failure when explaining a find with a UUID CVE-2018-25004 4.9 MediumMarch 1, 2021
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Specially crafted regex query can cause DoS CVE-2020-7929 Fix available 6.5 MediumMarch 1, 2021
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Denial of service via malformed network packet CVE-2019-20925 Fix available 7.5 HighNovember 24, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Infinite loop in aggregation expression CVE-2018-20803 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Improper neutralization of null byte leads to read overrun CVE-2020-7928 Fix available 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Crash while joining collections with $lookup CVE-2019-2393 6.5 MediumNovember 23, 2020
• mongodb, mongodb server, mongodb, inc. mongodb server +2 more Crash while handling internal Javascript exception types CVE-2019-20923 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Invariant in IndexBoundsBuilder CVE-2019-20924 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more $mod can result in undefined behavior CVE-2019-2392 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Invariant with $elemMatch CVE-2018-20805 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Post-auth queries on compound index may crash mongod CVE-2018-20802 Fix available 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Invariant failure in applyOps CVE-2018-20804 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Specific query can cause a DoS against MongoDB Server CVE-2020-7926 Fix available 6.5 MediumNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Denial of Service when processing malformed Role names CVE-2020-7925 Fix available 7.5 HighNovember 23, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Specific GeoQuery can cause DoS against MongoDB Server CVE-2020-7923 Fix available 6.5 MediumAugust 21, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Administrative action may disable enforcement of per-user IP whitelisting CVE-2020-7921 Fix available 4.6 MediumMay 6, 2020
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Process termination via PID file manipulation CVE-2019-2389 5.3 MediumAugust 30, 2019
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Code execution on Windows via OpenSSL engine injection CVE-2019-2390 8.2 HighAugust 30, 2019
• mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Authorization session conflation CVE-2019-2386 Fix available 7.1 HighAugust 6, 2019