Executive brief
MongoDB Server contains a vulnerability in its query planner that allows authenticated users with read-level access to crash the database server by submitting a specially crafted query against a collection with a text index. This can interrupt service for all connected clients and disrupt in-flight database operations, effectively creating a denial of service condition.
Technical details
The vulnerability exists in MongoDB's query planner's handling of text index queries and the internal $_internalSchemaCond stage used during JSON schema desugaring. An authenticated attacker with read-level privileges can exploit this by submitting a specially formed query that combines $text or $near operators with $_internalSchemaCond, causing the server process to terminate unexpectedly. The attack requires authentication and network access to the database. A successful exploit results in denial of service affecting all connected clients. Patches are available in MongoDB versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 7.0.40, before 8.0.29, before 8.2.13, before 8.3.8, before 9.0.0-rc2, before 9.1.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Patches released for versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0