Executive brief
A vulnerability in MongoDB Server allows a user with basic read-only access to crash the database service. By sending a specifically crafted data query using certain mathematical functions, an attacker can cause the system to shut down unexpectedly. This results in a denial-of-service (DoS) condition, disrupting business operations and application availability until the service is restored.
Technical details
A denial of service vulnerability exists in MongoDB Server due to insufficient validation of sort specifications in the $linearFill window function operator. An authenticated attacker with read-only privileges can provide a sortBy expression type (such as expression-based sort parts like $meta) that the operator cannot handle, leading to a NULL pointer dereference (CWE-476) and subsequent process termination (mongod). The $linearFill operator requires a stable numeric or date field path for linear interpolation, which expression-based sorts do not provide. The issue is addressed in versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc1 by rejecting expression-based sortBy in the parser.
Affected products
- MongoDB MongoDB Server 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2.0 before 8.2.12, 8.3.0 before 8.3.7, 9.0.0-rc1
Timeline
- 2026-05-20: other: Issue reported internally in MongoDB Jira
- 2026-07-22: disclosed: CVE published