Advisories · Technology
MongoDB Server.
Every CVE that names MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
- MongoDB Server
- Broken access control
- CVSS 5.3 Medium
Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
- MongoDB Server
- Broken access control
- CVSS 7.1 High
MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
- MongoDB Server
- CWE-441
- CVSS 5.3 Medium
libmongocrypt Improper Input Validation Leading to Process Termination
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
- MongoDB Server
- Memory corruption
- CVSS 7.2 High
tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
- MongoDB Server
- Broken access control
- CVSS 2.3 Low
MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse
- MongoDB Server
- Broken access control
- CVSS 7.1 High
Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
- MongoDB Server
- Denial of service
- CVSS 6.0 Medium
Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
- MongoDB Server
- Memory corruption
- CVSS 7.1 High
Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination
- MongoDB Server
- Memory corruption
- CVSS 9.2 CriticalCritical · CVSS 9+
MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
- MongoDB Server
- Memory corruption
- CVSS 5.3 Medium
MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination
- MongoDB Server
- Denial of service
- CVSS 6.9 Medium
Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
- MongoDB Server
- Denial of service
- CVSS 7.1 High
$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Aggregation Framework Memory Exhaustion Leading to Process Termination
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
- MongoDB Server
- Memory corruption
- CVSS 6.3 Medium
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
- MongoDB Server
- Broken access control
- CVSS 8.7 High
Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
- MongoDB Server
- Denial of service
- CVSS 6.8 Medium
Keyfile contents are in MongoDB Server logs
- MongoDB Server
- Information disclosure
- CVSS 7.2 High
Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
- MongoDB Server
- CWE-1287
- CVSS 7.1 High
GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
- MongoDB Server
- Memory corruption
- CVSS 6.8 Medium
Sensitive data could be written to mongod.log
- MongoDB Server
- Information disclosure
- CVSS 7.1 High
Metadata name collision on $-prefixed fields causes post-auth server crash
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Using MaxKey() may crash the server
- MongoDB Server
- Denial of service
- CVSS 7.1 High
$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Crafted cross-shard merge aggregation crashes MongoDB Server
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Server crashes in case of the use of exchange
- MongoDB Server
- Denial of service
- CVSS 7.1 High
Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
- MongoDB server
- Memory corruption
- CVSS 8.2 High
Authenticate command with specific mechanism parameter can trigger server crash
- MongoDB Server
- CWE-1287
- CVSS 7.1 High
Client side encryption fails to encrypt values in a $vectorSearch
- MongoDB Server
- Weak cryptography or TLS
- CVSS 5.3 Medium
Flaw in the updateUser Command May Allow Unauthorized Configuration Change
- MongoDB Server
- CWE-1284
- CVSS 7.1 High
MD5 checksum creation may cause availability loss
- MongoDB Server
- Memory corruption
- CVSS 6.0 Medium
Users could trigger a crash of mongod primaries during promotion to sharded
- MongoDB Server
- Denial of service