MongoDB vulnerabilities

CVE-2025-14847 [HIGH] CWE-130 CVE-2025-14847: Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Ser

CVE-2013-1892 [MEDIUM] CWE-20 CVE-2013-1892: MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.

CVE-2026-8053 [HIGH] CWE-787 CVE-2026-8053: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result

CVE-2013-3969 [MEDIUM] CWE-399 CVE-2013-3969: The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticat The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.

CVE-2025-3085 [CRITICAL] CWE-299 CVE-2025-3085: A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status check A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-c

CVE-2026-8201 [HIGH] CWE-416 CVE-2026-8201: A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis compo A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34,

CVE-2024-1351 [CRITICAL] CWE-295 CVE-2024-1351: Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB S

CVE-2025-6706 [HIGH] CWE-416 CVE-2025-6706: An authenticated user may trigger a use after free that may result in MongoDB Server crash and other An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expression

CVE-2015-7882 [HIGH] CWE-287 CVE-2015-7882: Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthe Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.

CVE-2024-8654 [CRITICAL] CWE-908 CVE-2024-8654: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

CVE-2026-11933 [HIGH] CWE-787 CVE-2026-11933: A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in di

CVE-2026-4148 [HIGH] CWE-416 CVE-2026-4148: A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with th A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

CVE-2024-10921 [HIGH] CWE-158 CVE-2024-10921: An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and

CVE-2026-4358 [HIGH] CWE-415 CVE-2026-4358: A specially crafted aggregation query with $lookup by an authenticated user with write privileges ca A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

CVE-2017-15535 [CRITICAL] CVE-2017-15535: MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.

CVE-2026-9740 [HIGH] CWE-674 CVE-2026-9740: A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash th A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

CVE-2019-20925 [HIGH] CWE-839 CVE-2019-20925: An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol m An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v

CVE-2025-3083 [HIGH] CWE-248 CVE-2025-3083: Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validat Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16

CVE-2025-10060 [HIGH] CWE-672 CVE-2025-10060: MongoDB Server may allow upsert operations retried within a transaction to violate unique index cons MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions pri

CVE-2026-6914 [HIGH] CWE-191 CVE-2026-6914: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of av Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32