Executive brief
A vulnerability in MongoDB Server allows an authenticated user to cause a denial-of-service condition. By using specific database commands with large inputs, an attacker can force the server's processor to run at 100% capacity for an extended period. This can lead to significant performance degradation or a complete service outage for other users and applications relying on the database.
Technical details
The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) within the MongoDB aggregation engine. It occurs when the $trim, $ltrim, or $rtrim operators are provided with a densely populated character mask and a large input string. An authenticated attacker with permissions to run aggregation pipelines can exploit this to exhaust CPU resources on the database server. The issue has been addressed by implementing limits on the mask string size in newer versions. Patches are available in MongoDB Server versions 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
Affected products
- MongoDB MongoDB Server 7.0 versions prior to 7.0.34, 8.0 versions prior to 8.0.23, 8.2 versions prior to 8.2.9, 8.3 versions prior to 8.3.2
Timeline
- 2026-03-02: other: Internal issue created in MongoDB Jira
- 2026-03-04: patched: Issue resolved in development branch
- 2026-05-13: disclosed: Public advisory and CVE published