Executive brief
MongoDB Server is a widely used database system. A vulnerability in how the database processes specific sorting requests could allow an authenticated user to crash the server. This results in a denial-of-service (DoS) condition, impacting the availability of applications and services that rely on the database.
Technical details
A Reachable Assertion (CWE-617) exists in MongoDB Server's query planning component. When processing sort patterns in raw BSONObj form, the planner fails to explicitly handle the '$meta' expression case (e.g., randVal, textScore). This leads to incorrect transformations where the planner treats a meta expression as a normal field path. Specifically, during 'analyzeSort' calls or 'isSortCovered' checks, this discrepancy can trigger an invariant failure, resulting in a server crash. The vulnerability is reachable via network by an authenticated user with permissions to execute find or aggregate commands. Patches are available in versions 7.0.39, 8.0.28, 8.2.12, and 8.3.7.
Affected products
- MongoDB MongoDB Server 7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, 8.3.0 < 8.3.7
Timeline
- 2026-06-05: other: Issue reported internally/created in Jira
- 2026-07-22: advisory: CVE published and NVD record created