Executive brief
A vulnerability in MongoDB Server allows an authenticated user to crash the database service. By sending a specific database query with an empty set of instructions to a 'view', an attacker can cause the server to stop responding. This results in a denial-of-service, impacting the availability of applications and data relying on the database.
Technical details
A NULL pointer dereference exists in MongoDB Server's aggregation engine when resolving views. The server inspects the aggregation pipeline to check for Atlas Search stages but fails to verify if the input pipeline array for $rankFusion or $scoreFusion is non-empty before accessing its first element. An authenticated attacker with network access can trigger this by supplying an empty pipeline, leading to a daemon crash (DoS). The issue is fixed in MongoDB Server versions 8.2.7, 8.3.0-rc1, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 8.2.0 to 8.2.6
Timeline
- 2026-03-17: patched: Issue resolved in development tracking system.
- 2026-05-07: disclosed: Initial advisory publication.