Executive brief
A vulnerability in MongoDB Server allows users with basic read permissions to crash or slow down the database by sending specially crafted queries. By using deeply nested data validation rules, an attacker can force the server to consume excessive CPU resources, leading to a denial-of-service. These malicious operations are particularly dangerous because they cannot be stopped by standard administrative commands once they start.
Technical details
An inefficient algorithmic complexity vulnerability (CWE-407) exists in the MongoDB Query Planner during the plan enumeration phase. The root cause is exponential behavior in the MatchExpressionHashVisitor when processing InternalSchema*MatchExpression nodes, where each level of nesting effectively doubles the hashing work. An attacker with basic read privileges can submit a query with deeply nested $jsonSchema constructs to cause a CPU-bound DoS. Because the query planning code lacks interrupt checks, these operations cannot be terminated via killOp(). The issue is resolved in MongoDB versions 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-05-01: other: Issue reported internally/via Jira
- 2026-06-05: patched: Issue resolved in source code
- 2026-07-22: advisory: CVE published and NVD record created