Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-9753

Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.3.0 to < 8.3.3affected
  • 8.2.0 to < 8.2.10affected
  • 8.0.0 to < 8.0.24affected
  • 7.0.0 to < 7.0.35affected

References