Executive brief
MongoDB Server is a widely used database system for storing and managing business data. A vulnerability has been identified where an authorized user with basic write permissions can crash the database service by sending a specifically malformed transaction command. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and application availability.
Technical details
A Reachable Assertion (CWE-617) vulnerability exists in MongoDB Server's transaction handling logic. The 'initializeOperationSessionInfo' component fails to consistently validate the precondition hierarchy for multi-document transactions; specifically, it does not reject the 'startOrContinueTransaction' field when the 'autocommit' field is missing. An authenticated attacker with network access and basic write privileges can exploit this inconsistent validation by sending a crafted transaction command, triggering a fatal internal invariant failure that crashes the mongod process. Patches are available in versions 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-05-27: other: Issue reported internally in MongoDB Jira
- 2026-07-22: disclosed: CVE published