Executive brief
A vulnerability in MongoDB Server 8.0 allows an authenticated user to crash the database service. By running a specifically designed data query (aggregation) followed by a request for more results, an attacker can trigger a system failure. This results in a denial of service, impacting the availability of applications and services that rely on the database.
Technical details
A NULL pointer dereference exists in MongoDB Server 8.0 within the DocumentSourceSetVariableFromSubPipeline::reattachToOperationContext() function. During the processing of certain aggregation pipelines (specifically involving $group stages), the _subPipeline field can be left as null. When a subsequent 'getMore' command is issued on the same cursor, the server attempts to dereference this null field while reattaching to the operation context, leading to an invalid memory access and process crash. This vulnerability requires network access and authentication with permissions to run aggregation pipelines. The issue is resolved in MongoDB Server version 8.0.24.
Affected products
- MongoDB MongoDB Server 8.0.0 through 8.0.23
Timeline
- 2026-04-08: other: Issue reported internally in MongoDB Jira
- 2026-06-09: patched: Fix version 8.0.24 released
- 2026-06-09: disclosed: CVE-2026-9743 published