Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 400

Export CSV
CVE-2026-106437

Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver
CVE-2026-106438

Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver
CVE-2026-107324

Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Go Driver
CVE-2026-107325

Application denial of service via missing BSON array length validation in MongoDB Go Driver

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Go Driver
CVE-2026-112368

Unbounded Recursion in phongo_bson_visit_document/visit_array:

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-104005

Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-104004

Collection validators using collation-accepting expressions can crash MongoDB Server on insert

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-87108

Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Ops Manager
CVE-2026-87109

Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Ops Manager
CVE-2026-87110

Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Ops Manager
CVE-2026-106435

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Python Driver
CVE-2026-106436

Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-106432

Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Php Driver
CVE-2026-96299

Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-96297

MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-103965

Fixed values in MongoDB Server $bucket stage may be misread as field references

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-106431

One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver
CVE-2026-106428

Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver
CVE-2026-106430

Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C++ Driver
CVE-2026-106429

Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Libmongocrypt