Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-13055

Server crash via aggregation pipeline expression with compound wildcard index specification

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 7.0 to < 7.0.39affected
  • 8.0 to < 8.0.28affected
  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References