Executive brief
A vulnerability in MongoDB Server allows an authenticated user to intentionally crash the database service. By sending a specifically crafted command involving data change streams, a user can trigger an internal error that shuts down the server. This results in a denial-of-service, impacting application availability and business operations until the service is manually restarted.
Technical details
A Reachable Assertion (CWE-617) exists in MongoDB Server when processing $changestreams and $_requestReshardingResumeToken with the 'exchange' option. The 'exchange' field is intended for internal communication between mongos and mongod instances; however, the server fails to properly restrict this field from external clients. Because certain code paths trust the contents of the exchange state, an attacker can provide unexpected input that triggers a failed invariant (assertion), leading to an immediate process crash. This is reachable over the network by any user with basic login privileges. The issue has been addressed in versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3 by forbidding the 'exchange' field from non-internal clients.
Affected products
- MongoDB MongoDB Server 7.0.35, 8.0.24, 8.2.10, 8.3.3
Timeline
- 2026-04-16: other: Issue reported internally to MongoDB
- 2026-06-09: patched: Fixes released in multiple versions
- 2026-06-09: advisory: CVE-2026-9746 published