Executive brief
A vulnerability in MongoDB Server allows an authenticated user to crash the database by sending specially crafted queries. By using specific commands that generate extremely large lists of data in the server's memory, an attacker can exhaust available resources and cause the service to shut down. This results in a denial-of-service, impacting the availability of applications and services that rely on the database.
Technical details
A resource exhaustion vulnerability (CWE-1325) exists in MongoDB Server's query execution engine. The flaw stems from improper memory allocation controls when processing certain array expressions, such as $concatArrays, $setUnion, and $zip, especially when combined with $range. An authenticated attacker with network access can submit a query that forces the server to allocate massive intermediate objects, exceeding available RAM and triggering an Out of Memory (OOM) error that crashes the mongod process. The issue is addressed in versions 8.0.28, 8.3.7, and 9.0.0-rc1 by improving memory checks for array expressions.
Affected products
- MongoDB MongoDB Server 8.0.0 before 8.0.28, 8.3.0 before 8.3.7
Timeline
- 2026-04-17: disclosed: Issue reported internally/created in Jira
- 2026-07-22: advisory: CVE published by NVD and MongoDB