Skip to contentMongodb, Inc. Mongodb Server vulnerabilities
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAwaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of ServiceCVE-2026-13074Fix available6.9 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion GenerationCVE-2026-13075Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation Framework Memory Exhaustion Leading to Process TerminationCVE-2026-13076Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreOut-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataCVE-2026-13077Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreLocal File Disclosure in MongoDB Server via MozJS Scripting Engine Module LoaderCVE-2026-13078Public exploitFix available6.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowCVE-2026-9740Fix available8.7 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreKeyfile contents are in MongoDB Server logsCVE-2026-9735Fix available6.8 Medium
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer crash via malformed binary diff passed to $_internalApplyOplogUpdate.CVE-2026-9753Fix available7.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreGeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationCVE-2026-9752Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreSensitive data could be written to mongod.logCVE-2026-9751Fix available6.8 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMetadata name collision on $-prefixed fields causes post-auth server crashCVE-2026-9750Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreUsing MaxKey() may crash the serverCVE-2026-9749Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputCVE-2026-9748Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreCrafted cross-shard merge aggregation crashes MongoDB ServerCVE-2026-9747Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreServer crashes in case of the use of exchangeCVE-2026-9746Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreAggregation sub-pipeline null dereference may allow DoS via crafted getMoreCVE-2026-9743Fix available7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthenticate command with specific mechanism parameter can trigger server crashCVE-2026-9742Fix available8.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreClient side encryption fails to encrypt values in a $vectorSearchCVE-2026-9741Fix available7.1 High
- mongodb, mongodb, inc. mongodb server +1 moreCalling createIndex with certain index types can crash mongodCVE-2026-8843Fix available7.1 High
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsCVE-2026-8202Fix available5.3 Medium
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication use-after-free error in $_internalJsEmit and mapreduce commandsCVE-2026-8336Fix available7.7 High
- mongodb, mongodb, inc. mongodb server +1 moreUse-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted FieldsCVE-2026-8201Fix available6.1 Medium
- mongodb, mongodb, inc. mongodb server +1 moreSchema validation log messages may not redact user dataCVE-2026-8200Fix available4.8 Medium
- mongodb, mongodb, inc. mongodb server +1 morePost-auth memory exhaustion via bitwise match expressionsCVE-2026-8199Fix available7.1 High
- mongodb, mongodb, inc. mongodb server +1 moreFlatBSON Duplicate Field Index DriftCVE-2026-8053Fix available8.7 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 morePost-auth null pointer dereference when aggregating against a view with empty search pipelineCVE-2026-8063Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreFlaw in the updateUser Command May Allow Unauthorized Configuration ChangeCVE-2026-6915Fix available5.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMD5 checksum creation may cause availability lossCVE-2026-6914Fix available7.1 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreUsers could trigger a crash of mongod primaries during promotion to shardedCVE-2026-5170Fix available6.0 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMemory safety issues in slot-based execution hash table spillCVE-2026-4358Fix available6.1 Medium
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operatorsCVE-2026-4148Fix available8.7 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreStack memory disclosure in filemd5 commandCVE-2026-4147Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreAn unsafe cast in the MongoDB query planner can result in a segmentation fault.CVE-2026-25613Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongod can run out of stack memory when expressions create deeply nested documentsCVE-2026-1849Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreAn authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplificationCVE-2026-1850Fix available7.1 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreprofile command may permit unauthorized configurationCVE-2026-25609Fix available5.3 Medium
- mongodb inc server, mongodb, mongodb, inc. mongodb server +2 moreInvalid $geoNear index hint may cause server crashCVE-2026-25610Fix available7.1 High
- mongodb inc server, mongodb, mongodb, inc. mongodb server +2 moreConnections received from the proxy port may not count towards total accepted connectionsCVE-2026-1848Fix available8.2 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMongoDB Server may crash when inserting large documentsCVE-2026-1847Fix available7.1 High
- mongodb inc server, mongodb, inc. mongodb server +1 moreInternal ResourceId collision may affect unrelated collectionsCVE-2026-256127.1 High
- mongodb inc server, mongodb, inc. mongodb server +1 morePre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerCVE-2026-256118.7 High
- mongodb, mongodb and mongodb server, mongodb inc. server +1 more +3 moreZlib compressed protocol header length confusion may allow memory readCVE-2025-14847In KEVPublic exploitFix availableEPSS 83.2%8.7 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreCross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB ServerCVE-2025-14345Fix available2.3 Low
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreMongoDB may be susceptible to Invariant Failure due to batched deleteCVE-2025-13644Fix available7.1 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreMongoDB Server may allow queries to be terminated by unauthorized usersCVE-2025-13643Fix available2.3 Low
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreImproper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB ServerCVE-2025-12893Fix available2.3 Low
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreTime-series operations may cause internal BSON size limit to be exceedCVE-2025-13507Fix available7.1 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreMalformed KMIP response may result in access violationCVE-2025-12657Fix available5.9 Medium
- mongodb inc server, mongodb, inc. mongodb server +1 moreMongoDB Windows installation MSI may leave ACLs unset on custom installation directoriesCVE-2025-104917.8 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 moreMalformed $group Query May Cause MongoDB Server to CrashCVE-2025-10061Fix available6.5 Medium
- Show moreLoading…