Executive brief
A vulnerability in MongoDB Server's data processing engine allows an authenticated user to potentially crash the database or access sensitive information from the server's memory. This occurs when the system processes a specially crafted data update command. An exploit could lead to service outages or the unauthorized exposure of customer data stored in the system's memory.
Technical details
The vulnerability is classified as an Improper Validation of Specified Type of Input (CWE-1287) within the $_internalApplyOplogUpdate aggregation pipeline stage. By submitting a specially crafted document diff containing a malformed binary diff, an authenticated attacker with permissions to execute the 'aggregate' command can trigger an out-of-bounds memory read. This can result in the disclosure of sensitive server memory or a complete crash of the mongod process (Denial of Service). The issue has been addressed in MongoDB Server versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3.
Affected products
- MongoDB MongoDB Server 7.0.x before 7.0.35, 8.0.x before 8.0.24, 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-21: other: Issue reported internally at MongoDB
- 2026-06-09: patched: Fixes released in multiple versions
- 2026-06-09: disclosed: Public advisory published