Executive brief
A vulnerability in MongoDB Server, a widely used database system, allows an unauthenticated attacker to remotely crash the database service. By sending a specially crafted message, an attacker can trigger a system failure that results in a denial-of-service (DoS) condition. This impact disrupts business operations and application availability until the database process is manually or automatically restarted.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in the BSON validation logic of MongoDB Server. The root cause is the BSON validator's handling of nested binary data structures, specifically involving BSONColumn nesting, which allows mutual recursion between validation functions. Each re-entry into these functions resets internal depth tracking, bypassing safety limits and leading to a stack overflow or process crash. This can be triggered by a remote, unauthenticated attacker sending a malicious BSON message. The issue is fixed in versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3.
Affected products
- MongoDB, Inc. MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-22: other: Issue created in MongoDB Jira
- 2026-06-08: patched: Issue resolved/fixed in development tracker
- 2026-06-09: advisory: CVE published and NVD record created