Executive brief
An authenticated user can crash a MongoDB database server by running specific complex search queries. This occurs when the server is already under memory pressure, causing the operating system to shut down the database process. Such an exploit results in a service outage, disrupting applications and business operations that rely on the database.
Technical details
A resource management vulnerability (CWE-770) exists in MongoDB Server's aggregation engine, specifically within the $rankFusion and $scoreFusion stages used for hybrid search. The flaw is located in the server's error-handling path. An authenticated attacker with permissions to run aggregation queries can trigger a condition where the operating system terminates the mongod process due to memory pressure. The vulnerability affects versions 8.2.x (prior to 8.2.12) and 8.3.x (prior to 8.3.7). Patches are available in versions 8.2.12, 8.3.7, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 8.2.0 to 8.2.11, 8.3.0 to 8.3.6
Timeline
- 2026-06-04: other: Issue reported internally/created in Jira
- 2026-06-08: patched: Issue resolved in development
- 2026-07-22: disclosed: CVE published and NVD record created