Executive brief
MongoDB Server has a vulnerability in its geospatial query processing that allows authenticated users with write access to store malformed geometry data without proper validation. When subsequent queries access this data, the server can crash or leak sensitive memory. This could disrupt database availability and potentially expose confidential information stored in server memory.
Technical details
The vulnerability exists in QueryPlannerAnalysis::analyzeGeo(), which incorrectly assumes that the presence of a 2dsphere v3 index guarantees all stored field values were validated on insertion. However, partial indexes only validate documents matching their partialFilterExpression, allowing unvalidated geometry to bypass validation checks when canSkipValidation is set. An authenticated attacker with write privileges can insert malformed geometry data, which is then processed by subsequent $geoWithin/$centerSphere queries without proper bounds checking, resulting in out-of-bounds memory access. The fix excludes partial indexes from skip-validation eligibility. MongoDB has released patches in versions 7.0.40, 8.0.29, 8.2.13, and later.
Affected products
- MongoDB Server before 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fixed in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0