Executive brief
A vulnerability in MongoDB's database engine can allow an authenticated user to crash the server by running a specific type of database query. This occurs when certain internal data processing steps are combined in a way the system does not expect, leading to an immediate shutdown of the database service. This impact is limited to service availability and does not directly result in the exposure or theft of customer data.
Technical details
The vulnerability is a reachable assertion (CWE-617) within the MongoDB aggregation engine. The $_internalConvertBucketIndexStats stage incorrectly uses the 'PauseExecution' signal to skip documents during failed index conversions. However, 'PauseExecution' is an internal signal intended only for TeeBuffer coordination within $facet sub-pipelines. If $_internalConvertBucketIndexStats is placed before a $facet stage in a pipeline, the TeeBuffer receives this unexpected signal and triggers a hard invariant assertion, resulting in a crash of the mongod process. This can be triggered by a network-based attacker with basic privileges to execute aggregation queries. The issue is fixed in versions 7.0.35, 8.0.24, 8.2.10, 8.3.3, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-13: other: Issue reported internally/created in Jira
- 2026-06-09: patched: Fix resolved in MongoDB Jira
- 2026-06-09: disclosed: CVE published