Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-9748 (GCVE-0-2026-9748)
Vulnerability from cvelistv5 – Published: 2026-06-09 22:08 – Updated: 2026-06-10 13:34
VLAI
EPSS
VEX
Title
$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
Summary
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-617 - Reachable assertion
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | MongoDB Server |
Affected:
8.3.0 , < 8.3.3
(semver)
Affected: 8.2.0 , < 8.2.10 (semver) Affected: 8.0.0 , < 8.0.10 (semver) Affected: 7.0.0 , < 7.0.35 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9748",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T13:34:04.659484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T13:34:29.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.3",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.2.10",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThan": "8.0.10",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.0.35",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \"skip this document\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod."
}
],
"value": "The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \"skip this document\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617 Reachable assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T22:08:22.075Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-123951"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-9748",
"datePublished": "2026-06-09T22:08:22.075Z",
"dateReserved": "2026-05-27T17:47:07.609Z",
"dateUpdated": "2026-06-10T13:34:29.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-9748",
"date": "2026-07-23",
"epss": "0.00323",
"percentile": "0.24647"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-9748\",\"sourceIdentifier\":\"cna@mongodb.com\",\"published\":\"2026-06-09T23:17:04.250\",\"lastModified\":\"2026-07-23T09:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \\\"skip this document\\\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.\"},{\"lang\":\"es\",\"value\":\"La etapa $_internalConvertBucketIndexStats us\u00f3 PauseExecution como una forma de se\u00f1alar \u0027saltar este documento\u0027 cuando fallaba una conversi\u00f3n de estad\u00edsticas de \u00edndice. Pero PauseExecution no es un mecanismo de salto de prop\u00f3sito general, sino m\u00e1s bien una se\u00f1al interna de TeeBuffer utilizada \u00fanicamente por $facet para coordinar sus sub-tuber\u00edas. Cuando esta etapa se coloca antes de $facet en una tuber\u00eda, TeeBuffer recibe el PauseExecution inesperado de upstream y alcanza una aserci\u00f3n invariante dura, colapsando mongod.\"}],\"affected\":[{\"source\":\"cna@mongodb.com\",\"affectedData\":[{\"vendor\":\"MongoDB\",\"product\":\"MongoDB Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"8.3.0\",\"lessThan\":\"8.3.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.2.0\",\"lessThan\":\"8.2.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"8.0.0\",\"lessThan\":\"8.0.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"7.0.0\",\"lessThan\":\"7.0.35\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T13:34:04.659484Z\",\"id\":\"CVE-2026-9748\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@mongodb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.35\",\"matchCriteriaId\":\"4A597EDD-7227-4462-9742-EC211F3D3043\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.0.10\",\"matchCriteriaId\":\"CB0E4B87-D42B-446A-A8C3-51258076AFF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.2.0\",\"versionEndExcluding\":\"8.2.10\",\"matchCriteriaId\":\"F3BDF7B8-82C8-4F03-9614-6FD73582D174\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0\",\"versionEndExcluding\":\"8.3.3\",\"matchCriteriaId\":\"565AB85D-0F4A-4ED3-B951-7949D7AB85A6\"}]}]}],\"references\":[{\"url\":\"https://jira.mongodb.org/browse/SERVER-123951\",\"source\":\"cna@mongodb.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"current_release_date": "2026-06-11T02:59:14+00:00",
"cve": "CVE-2026-9748",
"id": "CVE-2026-9748",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9748.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-9748\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T13:34:04.659484Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-10T13:34:20.658Z\"}}], \"cna\": {\"title\": \"$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input\", \"source\": {\"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"MongoDB\", \"product\": \"MongoDB Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.3.0\", \"lessThan\": \"8.3.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"lessThan\": \"8.2.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.0.0\", \"lessThan\": \"8.0.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"lessThan\": \"7.0.35\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://jira.mongodb.org/browse/SERVER-123951\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \\\"skip this document\\\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \\\"skip this document\\\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-617\", \"description\": \"CWE-617 Reachable assertion\"}]}], \"providerMetadata\": {\"orgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"shortName\": \"mongodb\", \"dateUpdated\": \"2026-06-09T22:08:22.075Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-9748\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-10T13:34:29.394Z\", \"dateReserved\": \"2026-05-27T17:47:07.609Z\", \"assignerOrgId\": \"a39b4221-9bd0-4244-95fc-f3e2e07f1deb\", \"datePublished\": \"2026-06-09T22:08:22.075Z\", \"assignerShortName\": \"mongodb\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
bit-mongodb-2026-9748
Vulnerability from bitnami_vulndb
Published
2026-06-16 11:48
Modified
2026-06-16 12:06
Summary
$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
Details
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mongodb",
"purl": "pkg:bitnami/mongodb"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.35"
},
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.10"
},
{
"introduced": "8.2.0"
},
{
"fixed": "8.2.10"
},
{
"introduced": "8.3.0"
},
{
"fixed": "8.3.3"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
],
"aliases": [
"CVE-2026-9748"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*"
],
"severity": "High"
},
"details": "The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \"skip this document\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.",
"id": "BIT-mongodb-2026-9748",
"modified": "2026-06-16T12:06:30.986Z",
"published": "2026-06-16T11:48:13.844Z",
"references": [
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-123951"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9748"
}
],
"schema_version": "1.6.2",
"summary": "$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input"
}
CERTFR-2026-AVI-0735
Vulnerability from certfr_avis - Published: 2026-06-11 - Updated: 2026-06-11
De multiples vulnérabilités ont été découvertes dans MongoDB. Elles permettent à un attaquant de provoquer un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| MongoDB | Core Server | Core Server versions 8.3.x antérieures à 8.3.3 | ||
| MongoDB | Core Server | Core Server versions antérieures à 7.0.35 | ||
| MongoDB | Core Server | Core Server versions 8.2.x antérieures à 8.2.10 | ||
| MongoDB | Core Server | Core Server versions 8.0.x antérieures à 8.0.24 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Core Server versions 8.3.x ant\u00e9rieures \u00e0 8.3.3",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Core Server versions ant\u00e9rieures \u00e0 7.0.35",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Core Server versions 8.2.x ant\u00e9rieures \u00e0 8.2.10",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
},
{
"description": "Core Server versions 8.0.x ant\u00e9rieures \u00e0 8.0.24",
"product": {
"name": "Core Server",
"vendor": {
"name": "MongoDB",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-9749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9749"
},
{
"name": "CVE-2026-9754",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9754"
},
{
"name": "CVE-2026-9752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9752"
},
{
"name": "CVE-2026-9741",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9741"
},
{
"name": "CVE-2026-9742",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9742"
},
{
"name": "CVE-2026-9743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9743"
},
{
"name": "CVE-2026-9735",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9735"
},
{
"name": "CVE-2026-9750",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9750"
},
{
"name": "CVE-2026-9753",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9753"
},
{
"name": "CVE-2026-9740",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9740"
},
{
"name": "CVE-2026-9751",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9751"
},
{
"name": "CVE-2026-9748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9748"
},
{
"name": "CVE-2026-9746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9746"
},
{
"name": "CVE-2026-9747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9747"
}
],
"initial_release_date": "2026-06-11T00:00:00",
"last_revision_date": "2026-06-11T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0735",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
"vendor_advisories": [
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123688",
"url": "https://jira.mongodb.org/browse/SERVER-123688"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123633",
"url": "https://jira.mongodb.org/browse/SERVER-123633"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-124959",
"url": "https://jira.mongodb.org/browse/SERVER-124959"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-124190",
"url": "https://jira.mongodb.org/browse/SERVER-124190"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123951",
"url": "https://jira.mongodb.org/browse/SERVER-123951"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-124031",
"url": "https://jira.mongodb.org/browse/SERVER-124031"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-126506",
"url": "https://jira.mongodb.org/browse/SERVER-126506"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-122207",
"url": "https://jira.mongodb.org/browse/SERVER-122207"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-125063",
"url": "https://jira.mongodb.org/browse/SERVER-125063"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-124183",
"url": "https://jira.mongodb.org/browse/SERVER-124183"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123507",
"url": "https://jira.mongodb.org/browse/SERVER-123507"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123918",
"url": "https://jira.mongodb.org/browse/SERVER-123918"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123370",
"url": "https://jira.mongodb.org/browse/SERVER-123370"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 MongoDB SERVER-123440",
"url": "https://jira.mongodb.org/browse/SERVER-123440"
}
]
}
FKIE_CVE-2026-9748
Vulnerability from fkie_nvd - Published: 2026-06-09 23:17 - Updated: 2026-07-23 09:10
Severity
Summary
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
References
| URL | Tags | ||
|---|---|---|---|
| cna@mongodb.com | https://jira.mongodb.org/browse/SERVER-123951 | Vendor Advisory |
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.3",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.2.10",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThan": "8.0.10",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.0.35",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"source": "cna@mongodb.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A597EDD-7227-4462-9742-EC211F3D3043",
"versionEndExcluding": "7.0.35",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CB0E4B87-D42B-446A-A8C3-51258076AFF2",
"versionEndExcluding": "8.0.10",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F3BDF7B8-82C8-4F03-9614-6FD73582D174",
"versionEndExcluding": "8.2.10",
"versionStartIncluding": "8.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"matchCriteriaId": "565AB85D-0F4A-4ED3-B951-7949D7AB85A6",
"versionEndExcluding": "8.3.3",
"versionStartIncluding": "8.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \"skip this document\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod."
},
{
"lang": "es",
"value": "La etapa $_internalConvertBucketIndexStats us\u00f3 PauseExecution como una forma de se\u00f1alar \u0027saltar este documento\u0027 cuando fallaba una conversi\u00f3n de estad\u00edsticas de \u00edndice. Pero PauseExecution no es un mecanismo de salto de prop\u00f3sito general, sino m\u00e1s bien una se\u00f1al interna de TeeBuffer utilizada \u00fanicamente por $facet para coordinar sus sub-tuber\u00edas. Cuando esta etapa se coloca antes de $facet en una tuber\u00eda, TeeBuffer recibe el PauseExecution inesperado de upstream y alcanza una aserci\u00f3n invariante dura, colapsando mongod."
}
],
"id": "CVE-2026-9748",
"lastModified": "2026-07-23T09:10:00.113",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "cna@mongodb.com",
"type": "Secondary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "cna@mongodb.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-9748",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T13:34:04.659484Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-09T23:17:04.250",
"references": [
{
"source": "cna@mongodb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://jira.mongodb.org/browse/SERVER-123951"
}
],
"sourceIdentifier": "cna@mongodb.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-617"
}
],
"source": "cna@mongodb.com",
"type": "Secondary"
}
]
}
GHSA-7R4J-G3F5-3629
Vulnerability from github – Published: 2026-06-10 00:31 – Updated: 2026-06-10 00:31
VLAI
Details
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-9748"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T23:17:04Z",
"severity": "HIGH"
},
"details": "The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \"skip this document\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.",
"id": "GHSA-7r4j-g3f5-3629",
"modified": "2026-06-10T00:31:50Z",
"published": "2026-06-10T00:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9748"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-123951"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
NCSC-2026-0209
Vulnerability from csaf_ncscnl - Published: 2026-06-23 09:52 - Updated: 2026-06-23 09:52Summary
Kwetsbaarheden verholpen in MongoDB Server
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: MongoDB heeft meerdere kwetsbaarheden verholpen in MongoDB Server.
Interpretaties: De kwetsbaarheden betreffen verschillende onderdelen van MongoDB Server. Een kwetsbaarheid in de loggingmechanismen kan ertoe leiden dat volledige authenticatiegegevens, inclusief gevoelige credentials, zonder redactie worden vastgelegd in serverlogs tijdens SASL-authenticatiesessies. Een andere kwetsbaarheid in de BSON-validatie veroorzaakt een crash van het mongod-proces door onbeheersbare wederzijdse recursie bij de validatie van geneste binaire data, wat resulteert in een denial-of-service.
Oplossingen: MongoDB heeft updates uitgebracht om de kwetsbaarheden in MongoDB Server te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-319: Cleartext Transmission of Sensitive Information
CWE-457: Use of Uninitialized Variable
CWE-476: NULL Pointer Dereference
CWE-532: Insertion of Sensitive Information into Log File
CWE-617: Reachable Assertion
CWE-674: Uncontrolled Recursion
CWE-787: Out-of-bounds Write
CWE-1287: Improper Validation of Specified Type of Input
MongoDB server may log full authentication credentials in server logs during SASL authentication when connection health metric logging is enabled, without redaction.
5.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
A vulnerability in MongoDB Server's BSON validation allows unauthenticated users to crash the mongod process by exploiting uncontrolled mutual recursion in nested binary data validation.
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
A bug in the $vectorSearch aggregation stage causes literal values for encrypted fields in filter expressions to be transmitted as plaintext rather than ciphertext, compromising encryption in Queryable Encryption and Client-Side Field Level Encryption.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
Enabling OIDC authentication permits unauthenticated clients to use the authenticate command with specific 'mechanism' parameters, which can trigger a server crash and cause a pre-authentication denial-of-service vulnerability.
7.5 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
MongoDB Server 8.0 contains a vulnerability in its aggregation pipeline where a null _subPipeline field can cause a crash and denial of service when an authenticated user issues a getMore command on the same cursor with a specially crafted aggregation.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
Using $changestreams and $_requestReshardingResumeToken with the exchange option causes a server crash due to an invariant violation, requiring only user login to execute the statement.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
Adding fromRouter:true and runtimeConstants.userRoles parameters can cause MongoDB server aggregations to crash, potentially impacting database stability during query execution.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
The $_internalConvertBucketIndexStats stage improperly used PauseExecution, intended only for $facet, causing crashes when TeeBuffer received unexpected signals during index stats conversion failures.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
An issue occurs in an aggregation pipeline using the internal $exchange stage with key-range partitioning and order-preserving delivery when a single key range's buffer fills, preventing the server from updating the internal high watermark as expected.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
An authenticated user can exploit insufficient separation between user document fields and internal metadata in MongoDB, potentially causing server crashes or incorrect query results.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
Setting the ldapQueryPassword parameter using the runtime setParameter command results in the new password being logged in plain text within the mongod.log file, exposing sensitive credentials.
5.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
An authorized user can trigger a server crash by executing a query with a 2dsphere index on a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS, due to insufficient validation causing a null-pointer dereference.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
A vulnerability in the $_internalApplyOplogUpdate aggregation pipeline stage allows any authenticated user with aggregate command access to trigger memory out-of-bounds access or server crashes via a malformed binary document diff.
8.1 (High)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
Authenticated users with read role can exploit the filemd5 command to read limited uninitialized stack memory, potentially exposing sensitive data.
6.5 (Medium)
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
MongoDB / MongoDB
|
vers:unknown/* | ||
|
vers:unknown/*
MongoDB / MongoDB Server
|
vers:unknown/* |
References
28 references
| URL | Category |
|---|---|
| https://jira.mongodb.org/browse/SERVER-122207 | external |
| https://jira.mongodb.org/browse/SERVER-123370 | external |
| https://jira.mongodb.org/browse/SERVER-123440 | external |
| https://jira.mongodb.org/browse/SERVER-123507 | external |
| https://jira.mongodb.org/browse/SERVER-123633 | external |
| https://jira.mongodb.org/browse/SERVER-123688 | external |
| https://jira.mongodb.org/browse/SERVER-123918 | external |
| https://jira.mongodb.org/browse/SERVER-123951 | external |
| https://jira.mongodb.org/browse/SERVER-124031 | external |
| https://jira.mongodb.org/browse/SERVER-124183 | external |
| https://jira.mongodb.org/browse/SERVER-124190 | external |
| https://jira.mongodb.org/browse/SERVER-124959 | external |
| https://jira.mongodb.org/browse/SERVER-125063 | external |
| https://jira.mongodb.org/browse/SERVER-126506 | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "MongoDB heeft meerdere kwetsbaarheden verholpen in MongoDB Server.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende onderdelen van MongoDB Server. Een kwetsbaarheid in de loggingmechanismen kan ertoe leiden dat volledige authenticatiegegevens, inclusief gevoelige credentials, zonder redactie worden vastgelegd in serverlogs tijdens SASL-authenticatiesessies. Een andere kwetsbaarheid in de BSON-validatie veroorzaakt een crash van het mongod-proces door onbeheersbare wederzijdse recursie bij de validatie van geneste binaire data, wat resulteert in een denial-of-service.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "MongoDB heeft updates uitgebracht om de kwetsbaarheden in MongoDB Server te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "general",
"text": "Use of Uninitialized Variable",
"title": "CWE-457"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "general",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "general",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-122207"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123370"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123440"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123507"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123633"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123688"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123918"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-123951"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-124031"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-124183"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-124190"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-124959"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-125063"
},
{
"category": "external",
"summary": "Reference",
"url": "https://jira.mongodb.org/browse/SERVER-126506"
}
],
"title": "Kwetsbaarheden verholpen in MongoDB Server",
"tracking": {
"current_release_date": "2026-06-23T09:52:48.437837Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0209",
"initial_release_date": "2026-06-23T09:52:48.437837Z",
"revision_history": [
{
"date": "2026-06-23T09:52:48.437837Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "MongoDB"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "MongoDB Server"
}
],
"category": "vendor",
"name": "MongoDB"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-9735",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "description",
"text": "MongoDB server may log full authentication credentials in server logs during SASL authentication when connection health metric logging is enabled, without redaction.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9735 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9735.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9735"
},
{
"cve": "CVE-2026-9740",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "description",
"text": "A vulnerability in MongoDB Server\u0027s BSON validation allows unauthenticated users to crash the mongod process by exploiting uncontrolled mutual recursion in nested binary data validation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9740 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9740.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9740"
},
{
"cve": "CVE-2026-9741",
"cwe": {
"id": "CWE-319",
"name": "Cleartext Transmission of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Transmission of Sensitive Information",
"title": "CWE-319"
},
{
"category": "description",
"text": "A bug in the $vectorSearch aggregation stage causes literal values for encrypted fields in filter expressions to be transmitted as plaintext rather than ciphertext, compromising encryption in Queryable Encryption and Client-Side Field Level Encryption.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9741 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9741.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9741"
},
{
"cve": "CVE-2026-9742",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "description",
"text": "Enabling OIDC authentication permits unauthenticated clients to use the authenticate command with specific \u0027mechanism\u0027 parameters, which can trigger a server crash and cause a pre-authentication denial-of-service vulnerability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9742 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9742.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9742"
},
{
"cve": "CVE-2026-9743",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "MongoDB Server 8.0 contains a vulnerability in its aggregation pipeline where a null _subPipeline field can cause a crash and denial of service when an authenticated user issues a getMore command on the same cursor with a specially crafted aggregation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9743 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9743.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9743"
},
{
"cve": "CVE-2026-9746",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "Using $changestreams and $_requestReshardingResumeToken with the exchange option causes a server crash due to an invariant violation, requiring only user login to execute the statement.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9746 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9746.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9746"
},
{
"cve": "CVE-2026-9747",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "Adding fromRouter:true and runtimeConstants.userRoles parameters can cause MongoDB server aggregations to crash, potentially impacting database stability during query execution.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9747 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9747.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9747"
},
{
"cve": "CVE-2026-9748",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "The $_internalConvertBucketIndexStats stage improperly used PauseExecution, intended only for $facet, causing crashes when TeeBuffer received unexpected signals during index stats conversion failures.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9748 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9748.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9748"
},
{
"cve": "CVE-2026-9749",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "An issue occurs in an aggregation pipeline using the internal $exchange stage with key-range partitioning and order-preserving delivery when a single key range\u0027s buffer fills, preventing the server from updating the internal high watermark as expected.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9749 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9749.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9749"
},
{
"cve": "CVE-2026-9750",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "other",
"text": "Reachable Assertion",
"title": "CWE-617"
},
{
"category": "description",
"text": "An authenticated user can exploit insufficient separation between user document fields and internal metadata in MongoDB, potentially causing server crashes or incorrect query results.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9750 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9750.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9750"
},
{
"cve": "CVE-2026-9751",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information into Log File",
"title": "CWE-532"
},
{
"category": "description",
"text": "Setting the ldapQueryPassword parameter using the runtime setParameter command results in the new password being logged in plain text within the mongod.log file, exposing sensitive credentials.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9751 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9751.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9751"
},
{
"cve": "CVE-2026-9752",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "description",
"text": "An authorized user can trigger a server crash by executing a query with a 2dsphere index on a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS, due to insufficient validation causing a null-pointer dereference.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9752 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9752.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9752"
},
{
"cve": "CVE-2026-9753",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A vulnerability in the $_internalApplyOplogUpdate aggregation pipeline stage allows any authenticated user with aggregate command access to trigger memory out-of-bounds access or server crashes via a malformed binary document diff.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9753 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9753.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9753"
},
{
"cve": "CVE-2026-9754",
"cwe": {
"id": "CWE-457",
"name": "Use of Uninitialized Variable"
},
"notes": [
{
"category": "other",
"text": "Use of Uninitialized Variable",
"title": "CWE-457"
},
{
"category": "description",
"text": "Authenticated users with read role can exploit the filemd5 command to read limited uninitialized stack memory, potentially exposing sensitive data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9754 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9754.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-9754"
}
]
}
ubuntu-cve-2026-9748
Vulnerability from osv_ubuntu
Published
2026-06-09 23:17
Modified
2026-06-09 23:17
Summary
Details
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
Severity
6.5 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:2.4.9-1ubuntu2+esm2"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:2.4.9-1ubuntu2+esm2"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:2.4.9-1ubuntu2+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb@1:2.4.9-1ubuntu2+esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:2.4.6-0ubuntu5",
"1:2.4.6-0ubuntu6",
"1:2.4.8-1ubuntu1",
"1:2.4.8-2",
"1:2.4.9-1",
"1:2.4.9-1ubuntu1",
"1:2.4.9-1ubuntu2",
"1:2.4.9-1ubuntu2+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:2.6.10-0ubuntu1+esm2"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:2.6.10-0ubuntu1+esm2"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:2.6.10-0ubuntu1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb@1:2.6.10-0ubuntu1+esm2?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:2.6.10-0ubuntu1",
"1:2.6.10-0ubuntu1+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
},
{
"binary_name": "mongodb-server-core",
"binary_version": "1:3.6.3-0ubuntu1.4+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb@1:3.6.3-0ubuntu1.4+esm2?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:3.4.7-1",
"1:3.4.7-1ubuntu1",
"1:3.4.7-1ubuntu2",
"1:3.4.7-1ubuntu4",
"1:3.4.14-3ubuntu1",
"1:3.4.14-3ubuntu2",
"1:3.6.3-0ubuntu1",
"1:3.6.3-0ubuntu1.1",
"1:3.6.3-0ubuntu1.3",
"1:3.6.3-0ubuntu1.4",
"1:3.6.3-0ubuntu1.4+esm1",
"1:3.6.3-0ubuntu1.4+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mongodb",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
},
{
"binary_name": "mongodb-clients",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
},
{
"binary_name": "mongodb-server",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
},
{
"binary_name": "mongodb-server-core",
"binary_version": "1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "mongodb",
"purl": "pkg:deb/ubuntu/mongodb@1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3",
"1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1"
]
}
],
"aliases": [],
"details": "The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal \"skip this document\" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.",
"id": "UBUNTU-CVE-2026-9748",
"modified": "2026-06-09T23:17:00Z",
"published": "2026-06-09T23:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-9748"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9748"
},
{
"type": "REPORT",
"url": "https://jira.mongodb.org/browse/SERVER-123951"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-9748"
]
}
WID-SEC-W-2026-1868
Vulnerability from csaf_certbund - Published: 2026-06-09 22:00 - Updated: 2026-06-10 22:00Summary
MongoDB: Mehrere Schwachstellen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: MongoDB ist ein Open-Source-Dokumentendatenbank.
Angriff: Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.
Betroffene Betriebssysteme: - Sonstiges
- UNIX
- Windows
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source MongoDB <7.0.35
Open Source / MongoDB
|
<7.0.35 | ||
|
Open Source MongoDB <8.0.24
Open Source / MongoDB
|
<8.0.24 | ||
|
Open Source MongoDB <8.2.10
Open Source / MongoDB
|
<8.2.10 | ||
|
Open Source MongoDB <8.3.3
Open Source / MongoDB
|
<8.3.3 |
References
24 references
| URL | Category |
|---|---|
| https://wid.cert-bund.de/.well-known/csaf/white/2… | self |
| https://wid.cert-bund.de/portal/wid/securityadvis… | self |
| https://jira.mongodb.org/browse/SERVER-126506 | external |
| https://jira.mongodb.org/browse/SERVER-125063 | external |
| https://jira.mongodb.org/browse/SERVER-123507 | external |
| https://jira.mongodb.org/browse/SERVER-124183 | external |
| https://jira.mongodb.org/browse/SERVER-123688 | external |
| https://jira.mongodb.org/browse/SERVER-124190 | external |
| https://jira.mongodb.org/browse/SERVER-123918 | external |
| https://jira.mongodb.org/browse/SERVER-123951 | external |
| https://jira.mongodb.org/browse/SERVER-124031 | external |
| https://jira.mongodb.org/browse/SERVER-123633 | external |
| https://jira.mongodb.org/browse/SERVER-123370 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35856 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35857 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35859 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35860 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35861 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35862 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35863 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35864 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35865 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35866 | external |
| https://euvd.enisa.europa.eu/enisa/EUVD-2026-35867 | external |
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "MongoDB ist ein Open-Source-Dokumentendatenbank.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder vertrauliche Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1868 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1868.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1868 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1868"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-126506"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-125063"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-123507"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-124183"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-123688"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-124190"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-123918"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-123951"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-124031"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-123633"
},
{
"category": "external",
"summary": "Jira MongoDB vom 2026-06-09",
"url": "https://jira.mongodb.org/browse/SERVER-123370"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35856"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35857"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35859"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35860"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35861"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35862"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35863"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35864"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35865"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35866"
},
{
"category": "external",
"summary": "EU Vulnerability Database vom 2026-06-09",
"url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-35867"
}
],
"source_lang": "en-US",
"title": "MongoDB: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-06-10T22:00:00.000+00:00",
"generator": {
"date": "2026-06-11T07:55:57.319+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1868",
"initial_release_date": "2026-06-09T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-06-09T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-06-10T22:00:00.000+00:00",
"number": "2",
"summary": "CVE\u0027s erg\u00e4nzt"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c8.3.3",
"product": {
"name": "Open Source MongoDB \u003c8.3.3",
"product_id": "T055184"
}
},
{
"category": "product_version",
"name": "8.3.3",
"product": {
"name": "Open Source MongoDB 8.3.3",
"product_id": "T055184-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mongodb:mongodb:8.3.3"
}
}
},
{
"category": "product_version_range",
"name": "\u003c8.2.10",
"product": {
"name": "Open Source MongoDB \u003c8.2.10",
"product_id": "T055185"
}
},
{
"category": "product_version",
"name": "8.2.10",
"product": {
"name": "Open Source MongoDB 8.2.10",
"product_id": "T055185-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mongodb:mongodb:8.2.10"
}
}
},
{
"category": "product_version_range",
"name": "\u003c8.0.24",
"product": {
"name": "Open Source MongoDB \u003c8.0.24",
"product_id": "T055186"
}
},
{
"category": "product_version",
"name": "8.0.24",
"product": {
"name": "Open Source MongoDB 8.0.24",
"product_id": "T055186-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mongodb:mongodb:8.0.24"
}
}
},
{
"category": "product_version_range",
"name": "\u003c7.0.35",
"product": {
"name": "Open Source MongoDB \u003c7.0.35",
"product_id": "T055187"
}
},
{
"category": "product_version",
"name": "7.0.35",
"product": {
"name": "Open Source MongoDB 7.0.35",
"product_id": "T055187-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mongodb:mongodb:7.0.35"
}
}
}
],
"category": "product_name",
"name": "MongoDB"
}
],
"category": "vendor",
"name": "Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-9735",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9735"
},
{
"cve": "CVE-2026-9740",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9740"
},
{
"cve": "CVE-2026-9741",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9741"
},
{
"cve": "CVE-2026-9742",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9742"
},
{
"cve": "CVE-2026-9743",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9743"
},
{
"cve": "CVE-2026-9746",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9746"
},
{
"cve": "CVE-2026-9747",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9747"
},
{
"cve": "CVE-2026-9748",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9748"
},
{
"cve": "CVE-2026-9749",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9749"
},
{
"cve": "CVE-2026-9750",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9750"
},
{
"cve": "CVE-2026-9751",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9751"
},
{
"cve": "CVE-2026-9752",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9752"
},
{
"cve": "CVE-2026-9753",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9753"
},
{
"cve": "CVE-2026-9754",
"product_status": {
"known_affected": [
"T055187",
"T055186",
"T055185",
"T055184"
]
},
"release_date": "2026-06-09T22:00:00.000+00:00",
"title": "CVE-2026-9754"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…