MongoDB Inc. MongoDB Server
41 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-8843 | 7.0 – < 7.0.32 ; 8.0 – < 8.0.21 ; 8.2 – < 8.2.6 | Calling createIndex with certain index types can crash mongod | HIGH 7.1 | 0.2 % | ||
| CVE-2026-8202 | 7.0 – < 7.0.34 ; 8.0 – < 8.0.23 ; 8.2 – < 8.2.9 ; … | Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-8336 | 8.2 – < 8.2.9 ; 8.3 – < 8.3.2 | Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands | HIGH 7.7 | 0.3 % | ||
| CVE-2026-8201 | 7.0 – < 7.0.34 ; 8.0 – < 8.0.23 ; 8.2 – < 8.2.9 ; … | Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-8200 | 7.0 – < 7.0.34 ; 8.0 – < 8.0.23 ; 8.2 – < 8.2.9 ; … | Schema validation log messages may not redact user data | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-8199 | 7.0 – < 7.0.34 ; 8.0 – < 8.0.23 ; 8.2 – < 8.2.9 ; … | Post-auth memory exhaustion via bitwise match expressions | HIGH 7.1 | 0.3 % | ||
| CVE-2026-8053 | 5.0 – < 5.0.33 ; 6.0 – < 6.0.28 ; 7.0 – < 7.0.34 ; … | FlatBSON Duplicate Field Index Drift | HIGH 8.7 | 0.7 % | ||
| CVE-2026-8063 | 8.2.0 – < 8.2.7 | Post-auth null pointer dereference when aggregating against a view with empty search pipeline | HIGH 7.1 | 0.2 % | ||
| CVE-2025-14847 | 8.2 – < 8.2.3 ; 8.0 – < 8.0.17 ; 7.0 – < 7.0.28 ; … | Zlib compressed protocol header length confusion may allow memory read | HIGH 8.7 | 83 % | KEV | |
| CVE-2025-14345 | 7.0 – < 7.0.26 ; 8.0 – < 8.0.16 ; 8.2 – < 8.2.2 | Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server | LOW 2.3 | 0.2 % | ||
| CVE-2025-13644 | 8.0 – < 8.0.13 ; 7.0 – < 7.0.26 ; 8.1 – < 8.1.2 | MongoDB may be susceptible to Invariant Failure due to batched delete | HIGH 7.1 | 0.3 % | ||
| CVE-2025-13643 | 8.0 – < 8.0.14 ; 7.0 – < 7.0.26 | MongoDB Server may allow queries to be terminated by unauthorized users | LOW 2.3 | 0.2 % | ||
| CVE-2025-12893 | 7.0 – < 7.0.26 ; 8.0 – < 8.0.16 ; 8.2 – < 8.2.2 | Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server | LOW 2.3 | 0.1 % | ||
| CVE-2025-13507 | 7.0 – < 7.0.26 ; 8.0 – < 8.0.16 ; 8.2 – < 8.2.1 | Time-series operations may cause internal BSON size limit to be exceed | HIGH 7.1 | 0.3 % | ||
| CVE-2025-12657 | 6.0 – < 7.0.22 ; 8.0 – < 8.0.10 | Malformed KMIP response may result in access violation | MEDIUM 5.9 | 0.4 % | ||
| CVE-2022-24272 | 5.0 – 5.0.6 | MongoDB Server (mongod) may crash in response to unexpected requests | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-32040 | 5.0 – < 5.0.4 ; 4.4 – 4.4.28 ; 4.2 – < 4.2.16 | Large aggregation pipelines with a specific stage can crash mongod under default configuration | HIGH 7.5 | 2.0 % | ||
| CVE-2021-32036 | 5.0 – 5.0.3 ; 4.4 – 4.4.9 ; 4.2 – 4.2.16 ; … | Denial of Service and Data Integrity vulnerability in features command | HIGH 7.1 | 1.0 % | ||
| CVE-2021-20330 | 4.0 – < 4.0.27 ; 4.2 – < 4.2.16 ; 4.4 – < 4.4.9 | Specific replication command with malformed oplog entries can crash secondaries | MEDIUM 6.5 | 1.1 % | ||
| CVE-2021-32037 | 5.0 – 5.0.2 | User may trigger invariant when allowed to send commands directly to shards | MEDIUM 6.5 | 1.2 % | ||
| CVE-2021-20333 | 3.6 – < 3.6.20 ; 4.0 – < 4.0.21 ; 4.2 – < 4.2.10 | Server log entry spoofing via newline injection | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-20326 | 4.4 – < 4.4.4 | Specially crafted query may result in a denial of service of mongod | MEDIUM 6.5 | 0.9 % | ||
| CVE-2018-25004 | 3.6 – < 3.6.11 ; 4.0 – < 4.0.6 | Invariant failure when explaining a find with a UUID | MEDIUM 4.9 | 1.0 % | ||
| CVE-2020-7929 | 3.6 – < 3.6.21 ; 4.0 – < 4.0.20 | Specially crafted regex query can cause DoS | MEDIUM 6.5 | 1.3 % | ||
| CVE-2019-20925 | 4.2 – < 4.2.1 ; 4.0 – < 4.0.13 ; 3.6 – < 3.6.15 ; … | Denial of service via malformed network packet | HIGH 7.5 | 1.7 % | ||
| CVE-2018-20803 | 4.0 – < 4.0.5 ; 3.6 – < 3.6.10 ; 3.4 – < 3.4.19 | Infinite loop in aggregation expression | MEDIUM 6.5 | 1.4 % | ||
| CVE-2020-7928 | 4.4 – < 4.4.1 ; 4.2 – < 4.2.9 ; 4.0 – < 4.0.20 ; … | Improper neutralization of null byte leads to read overrun | MEDIUM 6.5 | 1.4 % | ||
| CVE-2019-2393 | 3.6 – < 3.6.15 ; 4.0 – < 4.0.13 ; 4.2 – < 4.2.1 | Crash while joining collections with $lookup | MEDIUM 6.5 | 1.2 % | ||
| CVE-2019-20923 | 4.0 – < 4.0.7 | Crash while handling internal Javascript exception types | MEDIUM 6.5 | 1.3 % | ||
| CVE-2019-20924 | 4.2 – < 4.2.2 | Invariant in IndexBoundsBuilder | MEDIUM 6.5 | 1.3 % | ||
| CVE-2019-2392 | 3.6 – < 3.6.20 ; 4.0 – < 4.0.20 ; 4.2 – < 4.2.9 ; … | $mod can result in undefined behavior | MEDIUM 6.5 | 1.3 % | ||
| CVE-2018-20805 | 3.6 – < 3.6.10 ; 4.0 – < 4.0.5 | Invariant with $elemMatch | MEDIUM 6.5 | 1.2 % | ||
| CVE-2018-20802 | 3.6 – < 3.6.9 ; 4.0 – < 4.0.3 | Post-auth queries on compound index may crash mongod | MEDIUM 6.5 | 1.6 % | ||
| CVE-2018-20804 | 3.6 – < 3.6.13 ; 4.0 – < 4.0.10 | Invariant failure in applyOps | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-7926 | 4.4 – < 4.4.1 | Specific query can cause a DoS against MongoDB Server | MEDIUM 6.5 | 1.4 % | ||
| CVE-2020-7925 | 4.2 – < 4.2.9 ; 4.4 – < 4.4.0-rc12 | Denial of Service when processing malformed Role names | HIGH 7.5 | 1.7 % | ||
| CVE-2020-7923 | 4.4 – < 4.4.0-rc7 ; 4.2 – < 4.2.8 ; 4.0 – < 4.0.19 | Specific GeoQuery can cause DoS against MongoDB Server | MEDIUM 6.5 | 1.3 % | ||
| CVE-2020-7921 | 4.2 – < 4.2.3 ; 4.0 – < 4.0.15 ; 3.6 – < 3.6.18 ; … | Administrative action may disable enforcement of per-user IP whitelisting | MEDIUM 5.3 | 0.7 % | ||
| CVE-2019-2389 | 4.0 – < 4.0.11 ; 3.6 – < 3.6.14 ; 3.4 – < 3.4.22 | Process termination via PID file manipulation | MEDIUM 5.3 | 0.3 % | ||
| CVE-2019-2390 | 4.0 – < 4.0.11 ; 3.6 – < 3.6.14 ; 3.4 – < 3.4.22 | Code execution on Windows via OpenSSL engine injection | HIGH 8.2 | 0.9 % | ||
| CVE-2019-2386 | 4.0 – < 4.0.9 ; 3.6 – < 3.6.13 ; 3.4 – < 3.4.22 | Authorization session conflation | HIGH 7.1 | 1.1 % |