Executive brief
A vulnerability in MongoDB's data processing engine can allow an authenticated user to crash the database server. By running a specific type of complex data query (aggregation pipeline) that handles large volumes of sorted data, a user can trigger an internal error that takes the service offline. This impacts the availability of the database and any applications relying on it, though it does not directly expose or modify customer data.
Technical details
A reachable assertion (CWE-617) exists in MongoDB's aggregation engine during the execution of the internal $exchange stage. When configured with key-range partitioning and order-preserving delivery, the server may fail to update an internal 'high watermark' if a single key range produces enough documents to fill the exchange buffer. Specifically, the `Exchange::getTargetConsumer` method incorrectly handles `MaxKey` values when using `std::upper_bound`, leading to an invariant failure and subsequent process termination. An authenticated attacker with permissions to run aggregation pipelines can exploit this to cause a denial-of-service. The issue is fixed in MongoDB versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3.
Affected products
- MongoDB MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-14: other: Issue reported internally in MongoDB Jira
- 2026-06-09: patched: Fixes released in multiple versions
- 2026-06-09: disclosed: CVE published to NVD