Executive brief
MongoDB Server's handling of specific query predicates against time-series data collections can be exploited by authenticated users with write permissions to crash the database server. An attacker with legitimate database access could trigger this vulnerability to cause a denial of service, disrupting database availability and requiring manual server restart.
Technical details
This vulnerability exists in MongoDB Server's query processor when handling certain query predicates against time-series collections with a metaField defined. The issue occurs during update operations where invalid jsonSchema filters are applied to time-series collections, causing a server crash (denial of service). The vulnerability requires authentication and write access to the affected collection; an attacker must be able to execute update commands with malformed $jsonSchema predicates. MongoDB has patched this issue in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 7.0.40, 8.0.x before 8.0.29, 8.1.x before 8.2.13, 8.3.x before 8.3.8, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0
Timeline
- 2026-08-11: disclosed: Advisory published
- 2026-08-11: patched: Fixed in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0