Executive brief
MongoDB is a widely-deployed database server used to store and retrieve application data. A vulnerability in its query filter parser allows attackers to craft specially-crafted database queries that trigger excessive memory consumption, ultimately crashing the database server and blocking all users from accessing the database.
Technical details
A memory amplification vulnerability exists in MongoDB's JSON Pointer parser used during $jsonSchema query filter processing. The parser fails to enforce adequate limits on iteration count or total allocation size when processing specially-crafted $jsonSchema filter fields, particularly via the encryptMetadata.keyId path. Attackers can send malicious find commands with deeply-nested JSON Pointer paths that cause the parser to allocate excessive heap memory. Under concurrent request load, this cumulative memory consumption exhausts available heap memory, triggering the server's out-of-memory handler to terminate the mongod process and deny service to all clients. The fix limits JSON Pointer path depth to 255 levels, consistent with existing document depth limits in the server.
Affected products
- MongoDB MongoDB Server 7.0 before 7.0.41, 8.0 before 8.0.30, 8.2 before 8.2.13, 8.3 before 8.3.9, 9.0 before 9.0.0-rc2, 9.1 before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released for versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0