Executive brief
A vulnerability in MongoDB Server allows an authorized user to crash the database service by performing specific data operations. By submitting a specially crafted geographic data query involving complex shapes, an attacker can cause the server to stop responding, leading to a denial-of-service. This impact can disrupt business operations and application availability, though it does not directly expose sensitive customer data.
Technical details
This vulnerability is a NULL pointer dereference (CWE-476) occurring during 2dsphere index key generation. While MongoDB has a guard to reject unsupported strict-winding polygons, the 'getNativeCRS()' function fails to inspect individual members within a GeometryCollection, returning 'SPHERE' by default and bypassing the safety check. When 'parseFromGeoJSON' encounters these members, it pushes a null pointer into the 'S2RegionUnion' vector, which is subsequently dereferenced in 'S2RegionUnion::GetRectBound()'. An authenticated attacker with network access and permissions to query or insert into indexed collections can exploit this to cause a denial-of-service (DoS). The issue is fixed in MongoDB versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3.
Affected products
- MongoDB MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-03: other: Issue reported internally/created in Jira
- 2026-06-09: patched: Fixes released in multiple versions
- 2026-06-09: disclosed: CVE published to NVD