Executive brief
A vulnerability in MongoDB Server allows an authenticated user to intentionally crash the database service. By submitting a specifically crafted data query, an attacker can trigger an internal error that forces the server to shut down. This results in a denial-of-service, disrupting application availability and business operations until the service is manually restarted.
Technical details
A Reachable Assertion (CWE-617) exists in MongoDB Server's aggregation engine. The `$_internalIndexKey` expression fails to correctly handle compound wildcard index specifications. When a user with permissions to run aggregation pipelines executes a query containing this expression against such an index, it triggers an internal consistency check that aborts the `mongod` process. This is a network-reachable vulnerability requiring low-privileged authentication. Fixes are available in versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-03-31: other: Issue reported internally/created in Jira
- 2026-07-22: disclosed: CVE published