822 matches found
CVE-2026-82060
CVE-2026-82060 is an insufficient validation flaw in MongoDB Server affecting sharded collections. During document insertion, shard key values were not properly validated, allowing authenticated users to store operator-shaped objects as shard key values. When change stream events for such documen...
Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...
EUVD-2026-72946
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...
CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...
CVE-2026-82059
CVE-2026-82059 affects MongoDB Server , where an internal aggregation expression was incorrectly exposed to any authenticated user instead of being restricted to internal cluster operations. An attacker with read-only privileges can craft a malformed index specification within this expression to ...
Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges...
CVE-2026-82057
MongoDB is affected by a type confusion in its WiredTiger storage engine . An authenticated user with readWrite privileges can specify a custom WiredTiger storage configuration option with an incompatible value during collection creation. When documents are subsequently read from the misconfigure...
CVE-2026-82058
MongoDB 's mongod server is vulnerable to a denial-of-service flaw in its JSON Schema validation error generation code. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error path performs an unsafe numeric conversion on t...
Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...
CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path...
CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the...
Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path...
EUVD-2026-72943
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...
CVE-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...
Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...
CVE-2026-82056
MongoDB server is affected by a race condition in its text index query parsing that leads to a heap use-after-free read when handling upsert retry paths . Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata can be dereferenced after the underlying st...
CVE-2026-82055 Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in a...
Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...
CVE-2026-82054
A denial-of-service vulnerability exists in MongoDB server's JSON Pointer parser , which is invoked during $jsonSchema query filter processing. A specially crafted $jsonSchema filter field causes the parser to process input without enforcing adequate limits on iteration count or total allocation ...
CVE-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size,...