Executive brief
A vulnerability in MongoDB Server could allow an authenticated user to crash the database service or potentially access sensitive information stored in memory. This occurs when the server processes specially crafted data requests that bypass standard validation checks. Exploitation could lead to service outages or unauthorized data exposure, impacting business operations and data confidentiality.
Technical details
An out-of-bounds (OOB) heap read vulnerability exists in MongoDB Server due to missing bounds checks in the BSON CodeWScope element accessors. An authenticated attacker can exploit this by submitting malformed BSONColumn data that bypasses wire-level BSON validation. During decompression of the forged element, the server performs pointer arithmetic using an unchecked size value. This can result in a denial-of-service (server crash) or the disclosure of adjacent heap memory contents. The issue is tracked as CWE-125 and affects multiple versions of MongoDB Server, with fixes available in versions 7.0.39, 8.0.28, 8.2.12, 8.3.7, and 9.0.0-rc1.
Affected products
- MongoDB MongoDB Server 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2.0 before 8.2.12, 8.3.0 before 8.3.7
Timeline
- 2026-06-16: disclosed: Issue reported to MongoDB JIRA
- 2026-07-22: advisory: CVE-2026-13077 published by NVD