https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T23:20:56.995460+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-9748 CVE-2026-9748 — $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input 2026-09-30T23:20:57.058646+00:00

Affected: MongoDB Server

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

 https://vulnerability.circl.lu/vuln/ghsa-7r4j-g3f5-3629 GHSA-7r4j-g3f5-3629 2026-09-30T23:20:57.058761+00:00

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.