Executive brief
MongoDB Server contains a flaw in its query processing engine that could allow a valid database user to crash the server by submitting a specially crafted query. The impact is service unavailability—the database would go offline until manually restarted—but does not result in data theft or unauthorized access. This affects any organization running affected MongoDB versions and relying on database availability.
Technical details
The vulnerability is a type-mismatch bug in the query subsystem's expression tree serialization (expression_tree.cpp). When processing JSON Schema queries containing `{$jsonSchema: {not: {properties: ...}}}`, the code performs an invalid static_cast of an `INTERNAL_SCHEMA_MAX_PROPERTIES` match expression type to `PathMatchExpression`, a type it does not inherit from. This type confusion causes the mongod process to crash with a denial of service. Exploitation requires an authenticated database user with read privileges; no network attack vector exists. The fix, available in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, and 9.0.0-rc2 and later, moves the incorrect enum into the correct switch statement branch.
Affected products
- MongoDB Server before 7.0.40, 8.0.x before 8.0.29, 8.1.x before 8.2.13, 8.3.x before 8.3.8, 9.0.x before 9.0.0-rc2
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fixes available in 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0