Executive brief
A vulnerability in MongoDB Server allows an authenticated user to crash the database service. By running a specific data conversion command, an attacker can force the system to consume excessive memory, leading the operating system to shut down the MongoDB process. This results in a denial-of-service, impacting the availability of applications and services that rely on the database.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in MongoDB's aggregation framework during data type conversion operations. Specifically, using the $convert operator to transform BinData into an array can lead to disproportionate memory consumption. An attacker with network access, valid authentication, write access to the database, and the ability to run aggregation queries can trigger this memory pressure, causing the operating system to terminate the mongod process. The issue is addressed in MongoDB Server version 8.3.7 by adding memory checks for these specific conversion operations.
Affected products
- MongoDB MongoDB Server 8.3.0 to 8.3.6
Timeline
- 2026-06-09: other: Issue reported internally/created in Jira
- 2026-07-15: patched: Issue resolved in development
- 2026-07-22: advisory: CVE published and NVD record created