Advisories · Technology
MongoDB, Inc. MongoDB Server.
Every CVE that names MongoDB, Inc. MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Calling createIndex with certain index types can crash mongod
- MongoDB, Inc. MongoDB Server
- Denial of service
- CVSS 5.3 Medium
Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
- MongoDB, Inc. MongoDB Server
- Denial of service
- CVSS 7.7 High
Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands
- MongoDB, Inc. MongoDB Server
- Memory corruption
- CVSS 6.1 Medium
Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
- MongoDB, Inc. MongoDB Server
- Memory corruption
- CVSS 4.8 Medium
Schema validation log messages may not redact user data
- MongoDB, Inc. MongoDB Server
- Information disclosure
- CVSS 7.1 High
Post-auth memory exhaustion via bitwise match expressions
- MongoDB, Inc. MongoDB Server
- CWE-1325
- CVSS 8.7 High
FlatBSON Duplicate Field Index Drift
- MongoDB, Inc. MongoDB Server
- Memory corruption
- CVSS 7.1 High
Post-auth null pointer dereference when aggregating against a view with empty search pipeline
- MongoDB Inc. MongoDB Server
- Memory corruption
- CVSS 6.1 Medium
Memory safety issues in slot-based execution hash table spill
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 8.7 High
ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 7.1 High
Stack memory disclosure in filemd5 command
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 7.1 High
An unsafe cast in the MongoDB query planner can result in a segmentation fault.
- MongoDB Inc MongoDB Server
- CWE-704
- CVSS 7.1 High
Mongod can run out of stack memory when expressions create deeply nested documents
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 7.1 High
An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 5.3 Medium
profile command may permit unauthorized configuration
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 7.1 High
Invalid $geoNear index hint may cause server crash
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 8.2 High
Connections received from the proxy port may not count towards total accepted connections
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 7.1 High
MongoDB Server may crash when inserting large documents
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 7.1 High
Internal ResourceId collision may affect unrelated collections
- MongoDB Inc MongoDB Server
- CWE-412
- CVSS 8.7 High
Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
- MongoDB Inc MongoDB Server
- CWE-405
- CVSS 8.7 HighCritical · KEV, CVSS 7+ and EPSSKEV
Zlib compressed protocol header length confusion may allow memory read
- MongoDB Inc. MongoDB Server
- CWE-130
- CVSS 2.3 Low
Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
- MongoDB Inc. MongoDB Server
- CWE-667
- CVSS 7.1 High
MongoDB may be susceptible to Invariant Failure due to batched delete
- MongoDB Inc. MongoDB Server
- Denial of service
- CVSS 2.3 Low
MongoDB Server may allow queries to be terminated by unauthorized users
- MongoDB Inc. MongoDB Server
- Broken access control
- CVSS 2.3 Low
Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server
- MongoDB Inc. MongoDB Server
- Weak cryptography or TLS
- CVSS 7.1 High
Time-series operations may cause internal BSON size limit to be exceed
- MongoDB Inc. MongoDB Server
- CWE-1284
- CVSS 5.9 Medium
Malformed KMIP response may result in access violation
- MongoDB Inc. MongoDB Server
- CWE-754
- CVSS 7.8 High
MongoDB Windows installation MSI may leave ACLs unset on custom installation directories
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 6.5 Medium
Malformed $group Query May Cause MongoDB Server to Crash
- MongoDB Inc MongoDB Server
- CWE-20
- CVSS 6.5 Medium
MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation
- MongoDB Inc MongoDB Server
- CWE-672
- CVSS 6.5 Medium
MongoDB Server router will crash when incorrect lsid is set on a sharded query
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 6.5 Medium
Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 7.5 High
Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 7.7 High
MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 6.5 Medium
MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 4.4 Medium
Incomplete Redaction of Sensitive Information in MongoDB Server Logs
- MongoDB Inc MongoDB Server
- Information disclosure
- CVSS 7.5 High
Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 7.5 High
Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication
- MongoDB Inc MongoDB Server
- CWE-20
- CVSS 4.2 Medium
Race condition in privilege cache invalidation cycle
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 5.0 Medium
Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 8.1 High
MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked
- MongoDB Inc MongoDB Server
- CWE-299
- CVSS 6.5 Medium
MongoDB Server may crash due to improper validation of explain command
- MongoDB Inc MongoDB Server
- CWE-703
- CVSS 7.5 High
Malformed MongoDB wire protocol messages may cause mongos to crash
- MongoDB Inc MongoDB Server
- CWE-248
- CVSS 3.1 Low
User may override a view's collation and gain unauthorized access to underlying data
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 8.4 High
MongoDB C Driver bson library may be susceptible to buffer overflow
- MongoDB Inc libbson
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 6.8 Medium
Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
- MongoDB Inc MongoDB Server
- CWE-158
- CVSS 6.5 Medium
MongoDB Server secondaries may crash due to forced index constraints
- MongoDB Inc MongoDB Server
- CWE-1288
- CVSS 5.0 Medium
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour
- MongoDB Inc MongoDB Server
- Memory corruption
- CVSS 6.4 Medium
MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths
- MongoDB Inc MongoDB Server
- CWE-114
- CVSS 5.3 Medium
Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 7.3 High
Accessing Untrusted Directory May Allow Local Privilege Escalation
- MongoDB Inc MongoDB Server
- MongoDB Inc MongoDB C Driver
- Broken access control
- CVSS 5.4 Medium
Missing authorization check may lead to shard key refinement
- MongoDB Inc MongoDB Server
- Broken access control
- CVSS 5.3 Medium
MongoDB Server (mongod) may crash when generating ftdc
- MongoDB Inc MongoDB Server
- Denial of service
- CVSS 7.5 High
MongoDB Server may have unexpected application behaviour due to invalid BSON
- MongoDB Inc MongoDB Server
- CWE-20
- CVSS 8.8 High
MongoDB Server may allow successful untrusted connection
- MongoDB Inc MongoDB Server
- Weak cryptography or TLS
- CVSS 5.3 Medium
Certificate validation issue in MongoDB Server running on Windows or macOS
- MongoDB Inc MongoDB Server
- Weak cryptography or TLS
- CVSS 6.5 Medium
MongoDB Server (mongod) may crash in response to unexpected requests
- MongoDB Inc. MongoDB Server
- Denial of service
- CVSS 6.5 Medium
Large aggregation pipelines with a specific stage can crash mongod under default configuration
- MongoDB Inc. MongoDB Server
- Memory corruption
- CVSS 5.4 Medium
Denial of Service and Data Integrity vulnerability in features command
- MongoDB Inc. MongoDB Server
- Denial of service
- CVSS 6.5 Medium
Specific replication command with malformed oplog entries can crash secondaries
- MongoDB Inc. MongoDB Server
- CWE-20