Executive brief
A vulnerability in MongoDB Server allows an authorized user to crash the database service by creating specific types of invalid indexes. If an attacker creates these indexes on a standard data collection and then attempts to insert data, the server will encounter a fatal error and shut down. This results in a denial-of-service (DoS) condition, impacting the availability of applications and services relying on the database.
Technical details
A reachable assertion (CWE-617) exists in MongoDB Server due to improper validation of index types during creation. An authenticated attacker with permissions to create indexes can successfully create a '2dsphere_bucket' index on a non-timeseries collection or a 'queryable_encrypted_range' pseudo-index. While the creation command succeeds, subsequent document insertions that trigger an update to these invalid indexes cause the server to crash. The issue is resolved by implementing stricter index validation checks at creation time. Fixed versions include 7.0.32, 8.0.21, and 8.2.6.
Affected products
- MongoDB MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21, v8.2 versions prior to 8.2.6
Timeline
- 2026-01-07: other: Issue reported/created in Jira
- 2026-01-12: patched: Issue resolved in development
- 2026-05-18: advisory: CVE published