Executive brief
A vulnerability in MongoDB Server can cause the database to crash when it attempts to establish a secure connection to another system. This occurs if the remote system provides a specifically malformed security certificate response. Such a crash could lead to a service outage, disrupting business operations and data availability.
Technical details
A NULL pointer dereference (CWE-476) exists in the ocspClientCallback function of MongoDB Server. When the server initiates an outbound TLS connection and receives a malformed Online Certificate Status Protocol (OCSP) response from a remote peer, it may crash. This occurs because OCSP stapling validation is enabled by default for outgoing connections. An attacker must either control a remote peer with a certificate trusted by the cluster's CA or be positioned on an untrusted network path to intercept and modify the handshake. The vulnerability is fixed in versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory