CVE-2026-9750: MongoDB Server denial of service via internal metadata collision

Executive brief

A vulnerability in MongoDB Server allows authenticated users to cause a database crash or receive incorrect query results. By creating documents with specific field names that mimic internal system data, a user can interfere with how the database processes information during complex queries. This can lead to service outages or data integrity issues where the database returns inaccurate information.

Technical details

A Reachable Assertion (CWE-617) exists in MongoDB Server due to insufficient separation between user-controlled document fields and internal metadata. The `DocumentStorage::loadLazyMetadata()` function unconditionally consumes BSON fields prefixed with ' (such as `$textScore` or `$pt`) even when they originate from user data. This collision causes metadata corruption or type-mismatch errors, particularly during cross-shard aggregations where user fields are serialized alongside actual metadata. Attackers with basic authentication can exploit this to trigger server crashes or cause the database to return incorrect query results. The issue has been addressed in versions 7.0.35, 8.0.24, 8.2.10, 8.3.3, and 9.0.0-rc0 by implementing guards to prevent user-supplied fields from being reinterpreted as metadata.

Affected products

• MongoDB, Inc. MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3

Timeline

• 2026-04-08: other: Issue reported internally/created in Jira
• 2026-04-21: patched: Issue resolved in development branch
• 2026-06-09: disclosed: Public disclosure and CVE assignment

References

• https://jira.mongodb.org/browse/SERVER-123633