Executive brief
A vulnerability in MongoDB Server allows an authenticated user to crash the database service by sending a specially crafted aggregation request. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and application availability. The issue is caused by improper validation of internal routing parameters and user role constants during query processing.
Technical details
A Reachable Assertion (CWE-617) exists in MongoDB Server's aggregation engine. The vulnerability is triggered when a request includes 'fromRouter:true' and 'runtimeConstants.userRoles' is provided in an unexpected format (e.g., not an array of objects). An internal invariant check fails when encountering these malformed user-provided inputs, leading to an immediate process crash. This can be exploited by any authenticated client with permissions to execute aggregation commands. The issue has been addressed by implementing proper validation in the Interface Definition Language (IDL) layer and updating the invariant checks to more graceful assertions. Patches are available in versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3.
Affected products
- MongoDB MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-13: other: Issue reported internally/created in Jira
- 2026-06-09: patched: Fixes released in multiple versions
- 2026-06-09: disclosed: CVE published and NVD record created