Executive brief
A vulnerability in MongoDB Server's time-series data handling allows an authorized user with write access to crash the database or potentially execute malicious code. This affects organizations using MongoDB to store time-stamped data, such as IoT metrics or financial logs. An exploit could lead to a complete system takeover, data corruption, or a total service outage.
Technical details
An out-of-bounds (OOB) memory write vulnerability (CWE-787) exists in the 'mongod' process due to an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. The flaw is triggered when inserting data with duplicate field names into time-series collections. An attacker must be authenticated and possess database write privileges to exploit this issue. Successful exploitation can lead to memory corruption, process crashes, or arbitrary code execution. Patches are available in MongoDB Server versions 5.0.33, 6.0.28, 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
Affected products
- MongoDB MongoDB Server 5.0.0 - 5.0.32, 6.0.0 - 6.0.27, 7.0.0 - 7.0.33, 8.0.0 - 8.0.22, 8.2.0 - 8.2.8, 8.3.0 - 8.3.1
Timeline
- 2026-05-05: other: Issue created in MongoDB Jira
- 2026-05-12: patched: Fix resolved in internal tracking
- 2026-05-13: disclosed: Public disclosure and NVD publication