# MongoDB, Inc. MongoDB Server.

Every CVE that names MongoDB, Inc. MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Calling createIndex with certain index types can crash mongod](https://agentprime.io/advisories/CVE-2026-8843.md)
  `CVE-2026-8843` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 18 May 2026 · Tags: Denial of service
- [Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators](https://agentprime.io/advisories/CVE-2026-8202.md)
  `CVE-2026-8202` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: Denial of service
- [Post-authentication use-after-free error in $\_internalJsEmit and mapreduce commands](https://agentprime.io/advisories/CVE-2026-8336.md)
  `CVE-2026-8336` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 7.7 High · Not analysed yet · Published 13 May 2026 · Tags: Memory corruption
- [Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields](https://agentprime.io/advisories/CVE-2026-8201.md)
  `CVE-2026-8201` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 6.1 Medium · Not analysed yet · Published 13 May 2026 · Tags: Memory corruption
- [Schema validation log messages may not redact user data](https://agentprime.io/advisories/CVE-2026-8200.md)
  `CVE-2026-8200` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 4.8 Medium · Not analysed yet · Published 13 May 2026 · Tags: Information disclosure
- [Post-auth memory exhaustion via bitwise match expressions](https://agentprime.io/advisories/CVE-2026-8199.md)
  `CVE-2026-8199` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-1325
- [FlatBSON Duplicate Field Index Drift](https://agentprime.io/advisories/CVE-2026-8053.md)
  `CVE-2026-8053` · CVE record: MongoDB, Inc. MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 12 May 2026 · Tags: Memory corruption
- [Post-auth null pointer dereference when aggregating against a view with empty search pipeline](https://agentprime.io/advisories/CVE-2026-8063.md)
  `CVE-2026-8063` · CVE record: MongoDB Inc. MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption
- [Memory safety issues in slot-based execution hash table spill](https://agentprime.io/advisories/CVE-2026-4358.md)
  `CVE-2026-4358` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.1 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Memory corruption
- [ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators](https://agentprime.io/advisories/CVE-2026-4148.md)
  `CVE-2026-4148` · CVE record: MongoDB Inc MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 17 Mar 2026 · Tags: Memory corruption
- [Stack memory disclosure in filemd5 command](https://agentprime.io/advisories/CVE-2026-4147.md)
  `CVE-2026-4147` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 17 Mar 2026 · Tags: Memory corruption
- [An unsafe cast in the MongoDB query planner can result in a segmentation fault.](https://agentprime.io/advisories/CVE-2026-25613.md)
  `CVE-2026-25613` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-704
- [Mongod can run out of stack memory when expressions create deeply nested documents](https://agentprime.io/advisories/CVE-2026-1849.md)
  `CVE-2026-1849` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: Denial of service
- [An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification](https://agentprime.io/advisories/CVE-2026-1850.md)
  `CVE-2026-1850` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: Denial of service
- [profile command may permit unauthorized configuration](https://agentprime.io/advisories/CVE-2026-25609.md)
  `CVE-2026-25609` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: Broken access control
- [Invalid $geoNear index hint may cause server crash](https://agentprime.io/advisories/CVE-2026-25610.md)
  `CVE-2026-25610` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: Denial of service
- [Connections received from the proxy port may not count towards total accepted connections](https://agentprime.io/advisories/CVE-2026-1848.md)
  `CVE-2026-1848` · CVE record: MongoDB Inc MongoDB Server · CVSS 8.2 High · Not analysed yet · Published 10 Feb 2026 · Tags: Denial of service
- [MongoDB Server may crash when inserting large documents](https://agentprime.io/advisories/CVE-2026-1847.md)
  `CVE-2026-1847` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: Denial of service
- [Internal ResourceId collision may affect unrelated collections](https://agentprime.io/advisories/CVE-2026-25612.md)
  `CVE-2026-25612` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-412
- [Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server](https://agentprime.io/advisories/CVE-2026-25611.md)
  `CVE-2026-25611` · CVE record: MongoDB Inc MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-405
- [Zlib compressed protocol header length confusion may allow memory read](https://agentprime.io/advisories/CVE-2025-14847.md)
  `CVE-2025-14847` · CVE record: MongoDB Inc. MongoDB Server · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.83 · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-130
- [Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server](https://agentprime.io/advisories/CVE-2025-14345.md)
  `CVE-2025-14345` · CVE record: MongoDB Inc. MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-667
- [MongoDB may be susceptible to Invariant Failure due to batched delete](https://agentprime.io/advisories/CVE-2025-13644.md)
  `CVE-2025-13644` · CVE record: MongoDB Inc. MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 25 Nov 2025 · Tags: Denial of service
- [MongoDB Server may allow queries to be terminated by unauthorized users](https://agentprime.io/advisories/CVE-2025-13643.md)
  `CVE-2025-13643` · CVE record: MongoDB Inc. MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 25 Nov 2025 · Tags: Broken access control
- [Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server](https://agentprime.io/advisories/CVE-2025-12893.md)
  `CVE-2025-12893` · CVE record: MongoDB Inc. MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 25 Nov 2025 · Tags: Weak cryptography or TLS
- [Time-series operations may cause internal BSON size limit to be exceed](https://agentprime.io/advisories/CVE-2025-13507.md)
  `CVE-2025-13507` · CVE record: MongoDB Inc. MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-1284
- [Malformed KMIP response may result in access violation](https://agentprime.io/advisories/CVE-2025-12657.md)
  `CVE-2025-12657` · CVE record: MongoDB Inc. MongoDB Server · CVSS 5.9 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: CWE-754
- [MongoDB Windows installation MSI may leave ACLs unset on custom installation directories](https://agentprime.io/advisories/CVE-2025-10491.md)
  `CVE-2025-10491` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.8 High · Not analysed yet · Published 15 Sept 2025 · Tags: Broken access control
- [Malformed $group Query May Cause MongoDB Server to Crash](https://agentprime.io/advisories/CVE-2025-10061.md)
  `CVE-2025-10061` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-20
- [MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation](https://agentprime.io/advisories/CVE-2025-10060.md)
  `CVE-2025-10060` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-672
- [MongoDB Server router will crash when incorrect lsid is set on a sharded query](https://agentprime.io/advisories/CVE-2025-10059.md)
  `CVE-2025-10059` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Broken access control
- [Certain Queries with Duplicate \_id Fields May Cause MongoDB Server to Crash](https://agentprime.io/advisories/CVE-2025-7259.md)
  `CVE-2025-7259` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Memory corruption
- [Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections](https://agentprime.io/advisories/CVE-2025-6714.md)
  `CVE-2025-6714` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 7 Jul 2025 · Tags: Denial of service
- [MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage](https://agentprime.io/advisories/CVE-2025-6713.md)
  `CVE-2025-6713` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.7 High · Not analysed yet · Published 7 Jul 2025 · Tags: Broken access control
- [MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation](https://agentprime.io/advisories/CVE-2025-6712.md)
  `CVE-2025-6712` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Denial of service
- [Incomplete Redaction of Sensitive Information in MongoDB Server Logs](https://agentprime.io/advisories/CVE-2025-6711.md)
  `CVE-2025-6711` · CVE record: MongoDB Inc MongoDB Server · CVSS 4.4 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Information disclosure
- [Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB](https://agentprime.io/advisories/CVE-2025-6710.md)
  `CVE-2025-6710` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2025 · Tags: Denial of service
- [Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication](https://agentprime.io/advisories/CVE-2025-6709.md)
  `CVE-2025-6709` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2025 · Tags: CWE-20
- [Race condition in privilege cache invalidation cycle](https://agentprime.io/advisories/CVE-2025-6707.md)
  `CVE-2025-6707` · CVE record: MongoDB Inc MongoDB Server · CVSS 4.2 Medium · Not analysed yet · Published 26 Jun 2025 · Tags: Broken access control
- [Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server](https://agentprime.io/advisories/CVE-2025-6706.md)
  `CVE-2025-6706` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.0 Medium · Not analysed yet · Published 26 Jun 2025 · Tags: Memory corruption
- [MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked](https://agentprime.io/advisories/CVE-2025-3085.md)
  `CVE-2025-3085` · CVE record: MongoDB Inc MongoDB Server · CVSS 8.1 High · Not analysed yet · Published 1 Apr 2025 · Tags: CWE-299
- [MongoDB Server may crash due to improper validation of explain command](https://agentprime.io/advisories/CVE-2025-3084.md)
  `CVE-2025-3084` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2025 · Tags: CWE-703
- [Malformed MongoDB wire protocol messages may cause mongos to crash](https://agentprime.io/advisories/CVE-2025-3083.md)
  `CVE-2025-3083` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2025 · Tags: CWE-248
- [User may override a view's collation and gain unauthorized access to underlying data](https://agentprime.io/advisories/CVE-2025-3082.md)
  `CVE-2025-3082` · CVE record: MongoDB Inc MongoDB Server · CVSS 3.1 Low · Not analysed yet · Published 1 Apr 2025 · Tags: Broken access control
- [MongoDB C Driver bson library may be susceptible to buffer overflow](https://agentprime.io/advisories/CVE-2025-0755.md)
  `CVE-2025-0755` · CVE record: MongoDB Inc libbson and 1 more · CVSS 8.4 High · Not analysed yet · Published 18 Mar 2025 · Tags: Memory corruption
- [Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server](https://agentprime.io/advisories/CVE-2024-10921.md)
  `CVE-2024-10921` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.8 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-158
- [MongoDB Server secondaries may crash due to forced index constraints](https://agentprime.io/advisories/CVE-2024-8305.md)
  `CVE-2024-8305` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2024 · Tags: CWE-1288
- [MongoDB Server may access non-initialized region of memory leading to unexpected behaviour](https://agentprime.io/advisories/CVE-2024-8654.md)
  `CVE-2024-8654` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.0 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Memory corruption
- [MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths](https://agentprime.io/advisories/CVE-2024-8207.md)
  `CVE-2024-8207` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.4 Medium · Not analysed yet · Published 27 Aug 2024 · Tags: CWE-114
- [Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server](https://agentprime.io/advisories/CVE-2024-6384.md)
  `CVE-2024-6384` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: Broken access control
- [Accessing Untrusted Directory May Allow Local Privilege Escalation](https://agentprime.io/advisories/CVE-2024-7553.md)
  `CVE-2024-7553` · CVE record: MongoDB Inc MongoDB Server and 2 more · CVSS 7.3 High · Not analysed yet · Published 7 Aug 2024 · Tags: Broken access control
- [Missing authorization check may lead to shard key refinement](https://agentprime.io/advisories/CVE-2024-6375.md)
  `CVE-2024-6375` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.4 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Broken access control
- [MongoDB Server (mongod) may crash when generating ftdc](https://agentprime.io/advisories/CVE-2024-3374.md)
  `CVE-2024-3374` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Denial of service
- [MongoDB Server may have unexpected application behaviour due to invalid BSON](https://agentprime.io/advisories/CVE-2024-3372.md)
  `CVE-2024-3372` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-20
- [MongoDB Server may allow successful untrusted connection](https://agentprime.io/advisories/CVE-2024-1351.md)
  `CVE-2024-1351` · CVE record: MongoDB Inc MongoDB Server · CVSS 8.8 High · Not analysed yet · Published 7 Mar 2024 · Tags: Weak cryptography or TLS
- [Certificate validation issue in MongoDB Server running on Windows or macOS](https://agentprime.io/advisories/CVE-2023-1409.md)
  `CVE-2023-1409` · CVE record: MongoDB Inc MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2023 · Tags: Weak cryptography or TLS
- [MongoDB Server (mongod) may crash in response to unexpected requests](https://agentprime.io/advisories/CVE-2022-24272.md)
  `CVE-2022-24272` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2022 · Tags: Denial of service
- [Large aggregation pipelines with a specific stage can crash mongod under default configuration](https://agentprime.io/advisories/CVE-2021-32040.md)
  `CVE-2021-32040` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 12 Apr 2022 · Tags: Memory corruption
- [Denial of Service and Data Integrity vulnerability in features command](https://agentprime.io/advisories/CVE-2021-32036.md)
  `CVE-2021-32036` · CVE record: MongoDB Inc. MongoDB Server · CVSS 5.4 Medium · Not analysed yet · Published 4 Feb 2022 · Tags: Denial of service
- [Specific replication command with malformed oplog entries can crash secondaries](https://agentprime.io/advisories/CVE-2021-20330.md)
  `CVE-2021-20330` · CVE record: MongoDB Inc. MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 15 Dec 2021 · Tags: CWE-20

Older: <https://agentprime.io/advisories/technology/mongodb-inc-mongodb-server.md?cursor=WyIyMDIxLTEyLTE1VDEyOjMwOjEwLjQwNTAwMFoiLCJDVkUtMjAyMS0yMDMzMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mongodb-inc-mongodb-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mongodb-inc-mongodb-server/>. Everything for agents: <https://agentprime.io/llms.txt>.