Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-9748

$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.3.0 to < 8.3.3affected
  • 8.2.0 to < 8.2.10affected
  • 8.0.0 to < 8.0.10affected
  • 7.0.0 to < 7.0.35affected

References