MongoDB Inc MongoDB Server

• CVE-2025-14847 High 7.5 Exploited Zlib compressed protocol header length confusion may allow memory read 83.2%
• CVE-2026-8843 Medium 6.5 Calling createIndex with certain index types can crash mongod 0.2%
• CVE-2026-8202 Medium 4.3 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators 0.3%
• CVE-2026-8336 High 7.5 Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands 0.3%
• CVE-2026-8201 Medium 6.4 Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields 0.1%
• CVE-2026-8200 Low 2.7 Schema validation log messages may not redact user data 0.2%
• CVE-2026-8199 Medium 6.5 Post-auth memory exhaustion via bitwise match expressions 0.3%
• CVE-2026-8053 High 8.8 FlatBSON Duplicate Field Index Drift 0.7%
• CVE-2026-8063 Medium 6.5 Post-auth null pointer dereference when aggregating against a view with empty search pipeline 0.2%
• CVE-2026-4358 Medium 6.4 Memory safety issues in slot-based execution hash table spill 0.4%
• CVE-2026-4148 High 8.8 ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators 0.3%
• CVE-2026-4147 Medium 6.5 Stack memory disclosure in filemd5 command 0.2%
• CVE-2026-25613 Medium 6.5 An unsafe cast in the MongoDB query planner can result in a segmentation fault. 0.3%
• CVE-2026-1849 Medium 6.5 Mongod can run out of stack memory when expressions create deeply nested documents 0.3%
• CVE-2026-1850 Medium 6.5 An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification 0.3%
• CVE-2026-25609 Medium 5.4 profile command may permit unauthorized configuration 0.2%
• CVE-2026-25610 Medium 6.5 Invalid $geoNear index hint may cause server crash 0.3%
• CVE-2026-1848 High 7.5 Connections received from the proxy port may not count towards total accepted connections 0.3%
• CVE-2026-1847 Medium 6.5 MongoDB Server may crash when inserting large documents 0.3%
• CVE-2026-25612 Medium 6.5 Internal ResourceId collision may affect unrelated collections 0.2%
• CVE-2026-25611 High 7.5 Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server 0.9%
• CVE-2025-14345 Medium 4.2 Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server 0.2%
• CVE-2025-13644 Medium 6.5 MongoDB may be susceptible to Invariant Failure due to batched delete 0.3%
• CVE-2025-13643 Low 3.1 MongoDB Server may allow queries to be terminated by unauthorized users 0.2%
• CVE-2025-12893 Medium 4.2 Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server <0.1%
• CVE-2025-13507 Medium 6.5 Time-series operations may cause internal BSON size limit to be exceed 0.3%
• CVE-2025-12657 Medium 5.0 Malformed KMIP response may result in access violation 0.4%
• CVE-2025-10491 High 7.8 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories 0.1%
• CVE-2025-10061 Medium 6.5 Malformed $group Query May Cause MongoDB Server to Crash 0.3%
• CVE-2025-10060 Medium 6.5 MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation 0.4%
• CVE-2025-10059 Medium 6.5 MongoDB Server router will crash when incorrect lsid is set on a sharded query 0.3%
• CVE-2025-7259 Medium 6.5 Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash 0.3%
• CVE-2025-6714 High 7.5 Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections 0.4%
• CVE-2025-6713 High 7.7 MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage 0.5%
• CVE-2025-6712 Medium 6.5 MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation 0.3%
• CVE-2025-6711 Medium 4.4 Incomplete Redaction of Sensitive Information in MongoDB Server Logs 0.3%
• CVE-2025-6710 High 7.5 Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB 0.4%
• CVE-2025-6709 High 7.5 Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication 0.5%
• CVE-2025-6707 Medium 4.2 Race condition in privilege cache invalidation cycle 0.2%
• CVE-2025-6706 Medium 5.0 Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server 0.3%
• CVE-2025-3085 High 8.1 MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked 0.3%
• CVE-2025-3084 Medium 6.5 MongoDB Server may crash due to improper validation of explain command 0.4%
• CVE-2025-3083 High 7.5 Malformed MongoDB wire protocol messages may cause mongos to crash 0.5%
• CVE-2025-3082 Low 3.1 User may override a view's collation and gain unauthorized access to underlying data 0.2%
• CVE-2025-0755 High 8.4 MongoDB C Driver bson library may be susceptible to buffer overflow 0.8%
• CVE-2024-10921 Medium 6.8 Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server 0.6%
• CVE-2024-8305 Medium 6.5 MongoDB Server secondaries may crash due to forced index constraints 0.6%
• CVE-2024-8654 Medium 5.0 MongoDB Server may access non-initialized region of memory leading to unexpected behaviour 0.4%
• CVE-2024-8207 Medium 6.4 MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths 0.2%
• CVE-2024-6384 Medium 5.3 Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server 0.4%