MongoDB vulnerabilities

CVE-2025-14847 [HIGH] CWE-130 CVE-2025-14847: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Ser

CVE-2013-1892 [MEDIUM] CWE-20 CVE-2013-1892: MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.

CVE-2026-8053 [HIGH] CWE-787 CVE-2026-8053: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result

CVE-2013-3969 [MEDIUM] CWE-399 CVE-2013-3969: The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticat The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.

CVE-2025-3085 [CRITICAL] CWE-299 CVE-2025-3085: A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status check A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-c

CVE-2026-18692 [HIGH] CWE-416 CVE-2026-18692: An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated us An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

CVE-2026-8201 [HIGH] CWE-416 CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis compo A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34,

CVE-2026-82053 [HIGH] CWE-863 CVE-2026-82053: A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections ca A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments b

CVE-2026-82067 [HIGH] CWE-178 CVE-2026-82067: Improper handling of case sensitivity in the configuration validation component of MongoDB Server ma Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full i

CVE-2024-1351 [CRITICAL] CWE-295 CVE-2024-1351: Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB S

CVE-2026-13059 [HIGH] CWE-807 CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on da An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

CVE-2026-18691 [HIGH] CWE-757 CVE-2026-18691: An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable networ An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially all

CVE-2025-6706 [HIGH] CWE-416 CVE-2025-6706: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expression

CVE-2015-7882 [HIGH] CWE-287 CVE-2015-7882: Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthe Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.

CVE-2026-82071 [HIGH] CWE-787 CVE-2026-82071: Insufficient validation of storage engine configuration options in MongoDB Server allows an authenti Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with pot

CVE-2024-8654 [CRITICAL] CWE-908 CVE-2024-8654: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

CVE-2026-11933 [HIGH] CWE-787 CVE-2026-11933: A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in di

CVE-2026-18690 [HIGH] CWE-863 CVE-2026-18690: An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

CVE-2026-9753 [HIGH] CWE-1287 CVE-2026-9753: The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff con The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

CVE-2026-13078 [HIGH] CWE-862 CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine uncond A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to re