Executive brief
A vulnerability in MongoDB Server allows a user with basic read-only access to crash the database service. By sending a specially formatted data query, the attacker can force the database process to shut down unexpectedly. This results in a denial of service, preventing all users and applications from accessing the database until it is manually restarted.
Technical details
A Reachable Assertion (CWE-617) vulnerability exists in the MongoDB Server aggregation engine. The issue is caused by an internal engine selection inconsistency triggered when specific aggregation options are combined, specifically involving tailable and resumed scans in the Slot-Based Execution (SBE) engine. An authenticated attacker with 'read' permissions can exploit this over the network to trigger a process crash (SIGABRT). The vulnerability affects MongoDB Server version 8.0.x prior to 8.0.28 (and was also addressed in 8.0.2).
Affected products
- MongoDB MongoDB Server 8.0.0 to 8.0.27
Timeline
- 2026-06-08: disclosed: Issue reported internally/created in Jira
- 2026-06-22: patched: Issue resolved in development
- 2026-07-22: advisory: CVE published and NVD record created