Executive brief
MongoDB is a widely used database system for storing and managing business data. A vulnerability in its Queryable Encryption feature allows an authorized user to crash the database or make it unresponsive by sending a specially crafted request. This could lead to a service outage, preventing applications and employees from accessing critical data.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in MongoDB Server's Queryable Encryption (FLE2) implementation. The root cause is a lack of validation for the 'contention factor' field within a find payload, which controls an internal computation loop for binary searches. An authenticated attacker can provide an excessively high value (up to INT64_MAX), leading to high CPU consumption or out-of-memory (OOM) conditions. This degrades or destroys availability for the affected instance. Patches are available in versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-05-26: other: Vulnerability reported internally/created in Jira
- 2026-07-22: advisory: CVE published by MongoDB