Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-9747

Crafted cross-shard merge aggregation crashes MongoDB Server

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.3.0 to < 8.3.3affected
  • 8.2.0 to < 8.2.10affected
  • 8.0.0 to < 8.0.24affected
  • 7.0.0 to < 7.0.35affected

References