Advisories · Technology
MongoDB Server.
Every CVE that names MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
- MongoDB Server
- Memory corruption
- CVSS 5.3 Medium
Fixed values in MongoDB Server $bucket stage may be misread as field references
- MongoDB Server
- Code injection
- CVSS 7.1 High
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 6.0 Medium
MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
- MongoDB Server
- Memory corruption
- CVSS 7.7 High
Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
- MongoDB Server
- Race condition
- CVSS 7.1 High
Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
- MongoDB Server
- Memory corruption
- CVSS 8.7 High
Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
- MongoDB Server
- Broken access control
- CVSS 7.1 High
Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search
- MongoDB Server
- Broken access control
- CVSS 7.2 High
Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
- MongoDB Server
- Hard-coded credentials
- CVSS 5.1 Medium
Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
- MongoDB Server
- CWE-212
- CVSS 7.1 High
Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 9.2 CriticalCritical · CVSS 9+
Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
- MongoDB Server
- CWE-178
- CVSS 5.3 Medium
Heap Out-of-Bounds Read in MongoDB Server Query Planning Component
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
- MongoDB Server
- Denial of service
- CVSS 8.7 High
Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
- MongoDB Server
- Denial of service
- CVSS 6.0 Medium
Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 7.0 High
Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass
- MongoDB Server
- Broken access control
- CVSS 7.2 High
Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 2.3 Low
Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
- MongoDB Server
- Other injection
- CVSS 6.0 Medium
Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
- MongoDB Server
- CWE-248
- CVSS 7.1 High
Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 6.0 Medium
Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.6 High
Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
- MongoDB Server
- Broken access control
- CVSS 7.1 High
$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
- MongoDB Server
- Denial of service
- CVSS 7.2 High
Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
- MongoDB Server
- Broken access control
- CVSS 7.1 High
Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure
- MongoDB Server
- Memory corruption
- CVSS 5.9 Medium
Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency
- MongoDB Server
- Broken access control
- CVSS 5.3 Medium
Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command
- MongoDB Server
- Broken access control
- CVSS 7.2 High
Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections
- MongoDB Server
- Broken access control
- CVSS 6.0 Medium
Improper Input Validation in MongoDB Query Planner Leads to Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 9.0 CriticalCritical · CVSS 9+
Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
- MongoDB Server
- CWE-757
- CVSS 5.3 Medium
Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
- MongoDB Server
- Privilege escalation
- CVSS 7.1 High
Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure
- MongoDB Server
- Memory corruption
- CVSS 5.3 Medium
Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes
- MongoDB Server
- Code injection
- CVSS 7.0 High
Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections
- MongoDB Server
- Broken access control
- CVSS 6.0 Medium
Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Type Confusion in MongoDB Query Subsystem Leads to Denial of Service
- MongoDB Server
- Memory corruption
- CVSS 8.7 High
Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
- MongoDB Server
- Denial of service
- CVSS 7.2 High
Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data
- MongoDB Server
- CWE-807
- CVSS 7.1 High
Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
- MongoDB Server
- Broken access control
- CVSS 7.7 High
Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption
- MongoDB Server
- Memory corruption
- CVSS 7.5 High
Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
- MongoDB Server
- Memory corruption
- CVSS 5.3 Medium
Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 2.3 Low
Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method
- MongoDB Server
- Broken access control
- CVSS 7.1 High
Server crash via aggregation pipeline expression with compound wildcard index specification
- MongoDB Server
- Denial of service
- CVSS 7.1 High
A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
- MongoDB Server
- CWE-1325
- CVSS 6.0 Medium
Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META
- MongoDB Server
- CWE-20
- CVSS 7.1 High
Transaction Command Insufficient Input Validation Leading to Process Termination
- MongoDB Server
- Denial of service
- CVSS 8.6 High
Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
- MongoDB Server
- CWE-807
- CVSS 7.1 High
Find command with $meta sort can lead to crash
- MongoDB Server
- Denial of service