MongoDB Inc MongoDB Server
41 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-4358 | 8.2 – < 8.2.6 ; 8.0 – < 8.0.20 ; 7.0 – < 7.0.31 | Memory safety issues in slot-based execution hash table spill | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-4148 | 8.2 – < 8.2.6 ; 8.0 – < 8.0.20 ; 7.0 – < 7.0.31 | ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators | HIGH 8.7 | 0.3 % | ||
| CVE-2026-4147 | 8.2 – < 8.2.6 ; 8.0 – < 8.0.20 ; 7.0 – < 7.0.31 | Stack memory disclosure in filemd5 command | HIGH 7.1 | 0.2 % | ||
| CVE-2026-25613 | 7.0 – < 7.0.29 ; 8.0 – < 8.0.18 ; 8.2 – < 8.2.4 | An unsafe cast in the MongoDB query planner can result in a segmentation fault. | HIGH 7.1 | 0.3 % | ||
| CVE-2026-1849 | 8.0 – < 8.0.18 ; 7.0 – < 7.0.29 ; 8.2 – < 8.2.2 | Mongod can run out of stack memory when expressions create deeply nested documents | HIGH 7.1 | 0.3 % | ||
| CVE-2026-1850 | 8.0 – < 8.0.18 ; 8.2 – < 8.2.4 | An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification | HIGH 7.1 | 0.3 % | ||
| CVE-2026-25609 | 8.2 – < 8.2.4 ; 8.0 – < 8.0.18 ; 7.0 – < 7.0.29 | profile command may permit unauthorized configuration | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-25610 | 8.0 – < 8.0.13 ; 7.0 – < 7.0.29 | Invalid $geoNear index hint may cause server crash | HIGH 7.1 | 0.3 % | ||
| CVE-2026-1848 | 8.2 – < 8.2.4 ; 8.0 – < 8.0.18 ; 7.0 – < 7.0.29 | Connections received from the proxy port may not count towards total accepted connections | HIGH 8.2 | 0.3 % | ||
| CVE-2026-1847 | 8.0 – < 8.0.18 ; 7.0 – < 7.0.29 | MongoDB Server may crash when inserting large documents | HIGH 7.1 | 0.3 % | ||
| CVE-2026-25612 | 8.2 – < 8.2.4 ; 8.0 – < 8.0.18 ; 7.0 – < 7.0.29 | Internal ResourceId collision may affect unrelated collections | HIGH 7.1 | 0.2 % | ||
| CVE-2026-25611 | 8.2 – < 8.2.4 ; 8.0 – < 8.0.18 ; 7.0 – < 7.0.29 | Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server | HIGH 8.7 | 0.9 % | ||
| CVE-2025-10491 | 6.0 – < 6.0.25 ; 7.0 – < 7.0.21 ; 8.0 – < 8.0.5 | MongoDB Windows installation MSI may leave ACLs unset on custom installation directories | HIGH 7.8 | 0.1 % | ||
| CVE-2025-10061 | 6.0 – < 6.0.25 ; 7.0 – < 7.0.22 ; 8.0 – < 8.0.12 ; … | Malformed $group Query May Cause MongoDB Server to Crash | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-10060 | 6.0 – < 6.0.25 ; 7.0 – < 7.0.22 ; 8.0 – < 8.0.12 | MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation | HIGH 7.5 | 0.4 % | ||
| CVE-2025-10059 | 6.0 – < 6.0.24 ; 7.0 – < 7.0.18 ; 8.0 – < 8.0.6 | MongoDB Server router will crash when incorrect lsid is set on a sharded query | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-7259 | 8.1 – 8.1.0 | Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-6714 | 6.0 – < 6.0.23 ; 7.0 – < 7.0.20 ; 8.0 – < 8.0.9 | Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections | HIGH 7.5 | 0.4 % | ||
| CVE-2025-6713 | 6.0 – < 6.0.22 ; 7.0 – < 7.0.19 ; 8.0 – < 8.0.7 | MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage | HIGH 7.7 | 0.5 % | ||
| CVE-2025-6712 | 8.0 – < 8.0.10 | MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-6711 | 6.0 – < 6.0.21 ; 7.0 – < 7.0.18 ; 8.0 – < 8.0.5 | Incomplete Redaction of Sensitive Information in MongoDB Server Logs | MEDIUM 4.9 | 0.3 % | ||
| CVE-2025-6710 | 6.0 – < 6.0.21 ; 7.0 – < 7.0.17 ; 8.0 – < 8.0.5 | Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB | HIGH 7.5 | 0.4 % | ||
| CVE-2025-6709 | 7.0 – < 7.0.17 ; 8.0 – < 8.0.5 ; 6.0 – < 6.0.21 | Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication | HIGH 7.5 | 0.5 % | ||
| CVE-2025-6707 | 5.0 – < 5.0.31 ; 6.0 – < 6.0.24 ; 7.0 – < 7.0.21 ; … | Race condition in privilege cache invalidation cycle | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-6706 | 6.0 – < 6.0.21 ; 7.0 – < 7.0.17 ; 8.0 – < 8.0.4 | Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server | HIGH 8.8 | 0.3 % | ||
| CVE-2025-3085 | 5.0 – < 5.0.31 ; 6.0 – < 6.0.20 ; 7.0 – < 7.0.16 ; … | MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked | CRITICAL 9.8 | 0.3 % | ||
| CVE-2025-3084 | 5.0 – < 5.0.31 ; 6.0 – < 6.0.20 ; 7.0 – < 7.0.16 ; … | MongoDB Server may crash due to improper validation of explain command | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-3083 | 5.0 – < 5.0.31 ; 6.0 – < 6.0.20 ; 7.0. – < 7.0.16 | Malformed MongoDB wire protocol messages may cause mongos to crash | HIGH 7.5 | 0.5 % | ||
| CVE-2025-3082 | 5.0 – < 5.0.31 ; 6.0 – < 6.0.20 ; 7.0 – < 7.0.14 ; … | User may override a view's collation and gain unauthorized access to underlying data | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-0755 | 8.0 – < 8.0.1 ; 7.0 – < 7.0.16 | MongoDB C Driver bson library may be susceptible to buffer overflow | HIGH 8.4 | 0.8 % | ||
| CVE-2024-10921 | 5.0 – < 5.0.30 ; 6.0 – < 6.0.19 ; 7.0 – < 7.0.15 ; … | Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server | HIGH 8.1 | 0.6 % | ||
| CVE-2024-8305 | 6.0 – < 6.0.17 ; 7.0 – < 7.0.13 ; 7.3 – < 7.3.4 | MongoDB Server secondaries may crash due to forced index constraints | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-8654 | 6.0.3 | MongoDB Server may access non-initialized region of memory leading to unexpected behaviour | CRITICAL 9.8 | 0.4 % | ||
| CVE-2024-8207 | 6.0 – < 6.0.3 ; 5.0 – < 5.0.14 | MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths | MEDIUM 6.7 | 0.2 % | ||
| CVE-2024-6384 | 6.0 – < 6.0.16 ; 7.0 – < 7.0.11 ; 7.3 – < 7.3.3 | Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server | MEDIUM 5.3 | 0.4 % | ||
| CVE-2024-7553 | 5.0 – < 5.0.27 ; 6.0 – < 6.0.16 ; 7.0 – < 7.0.12 ; … | Accessing Untrusted Directory May Allow Local Privilege Escalation | HIGH 7.8 | 0.3 % | ||
| CVE-2024-6375 | 5.0 – < 5.0.22 ; 6.0 – < 6.0.11 ; 7.0 – < 7.0.3 | Missing authorization check may lead to shard key refinement | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-3374 | 5.0 – 5.0.16 ; 6.0 – 6.0.5 | MongoDB Server (mongod) may crash when generating ftdc | MEDIUM 5.3 | 0.5 % | ||
| CVE-2024-3372 | 5.0 – < 5.0.25 ; 6.0 – < 6.0.14 ; 7.0 – < 7.0.6 | MongoDB Server may have unexpected application behaviour due to invalid BSON | HIGH 7.5 | 0.5 % | ||
| CVE-2024-1351 | 7.0 – 7.0.5 ; 6.0 – 6.0.13 ; 5.0 – 5.0.24 ; … | MongoDB Server may allow successful untrusted connection | CRITICAL 9.8 | 0.5 % | ||
| CVE-2023-1409 | 6.3 – 6.3.2 ; 5.0 – 5.0.14 ; 4.4 – 4.4.23 | Certificate validation issue in MongoDB Server running on Windows or macOS | HIGH 7.5 | 0.4 % |