Executive brief
MongoDB Server contains a use-after-free vulnerability in its query execution memory management subsystem. An authenticated database user with read privileges can crash the server or corrupt memory by executing a specific sequence of database commands involving Exchange pipelines with UnionWith and memory-tracking stages. This could lead to service unavailability and potential data integrity issues.
Technical details
A use-after-free vulnerability exists in MongoDB's OperationMemoryUsageTracker when processing Exchange pipelines containing UnionWith operators with memory-tracking stages like setWindowFields. The vulnerability occurs when a consumer other than consumer-0 wins the race to construct the UnionWith subpipeline first; this creates a memory tracker stored on the client cursor that becomes a dangling pointer after cursor destruction. Subsequent consumers executing the exchange pipeline trigger a use-after-free when accessing the freed memory tracker. The attack requires authentication with read privileges and involves standard database commands; no user interaction is needed beyond query execution. MongoDB has patched this issue in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and 9.1.0-rc1024.
Affected products
- MongoDB Server before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in versions 8.3.9, 9.0.0-rc2, 9.1.0-rc0, 9.1.0-rc1024