Executive brief
MongoDB is a popular database platform used to store and retrieve application data. When malformed geographic data is inserted into a collection with a 2dsphere index, a software defect causes the database server to crash, resulting in service downtime. An authenticated user with write permissions can exploit this to disrupt operations.
Technical details
The vulnerability is a null pointer dereference in MongoDB's GeoJSON parsing logic for 2dsphere index key generation. When GeoJSON parsing fails, the GeometryContainer object fails to clean up its internal state (specifically the _polygon field), but the code then attempts a fallback to legacy point parsing. If the fallback succeeds, downstream geometry processing functions (projectInto, getS2Region) access the stale, uninitialized object state and dereference a null pointer, crashing the mongod process. The vulnerability requires an authenticated user with write access to insert a specially crafted GeoJSON document. The issue affects MongoDB 8.2 through 9.1 with V1–V4 index versions depending on release; versions 8.0 and 7.0 exit early on GeoJSON parsing failure and are not affected. Patches are available in versions 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later.
Affected products
- MongoDB MongoDB Server 7.0.0–9.1.0 (see notes)
Timeline
- 2026-09-08: disclosed: Vulnerability published in NVD
- 2026-09-08: patched: Fix versions released: 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0