DeutschShown in its original language — a full translation is planned for a future version.
MongoDB: Mehrere Schwachstellen
view advisory published 2026-06-09
Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-9754US | — | — | ||
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command | ||||
| CVE-2026-9753US | — | — | ||
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the serv… | ||||
| CVE-2026-9752US | — | — | ||
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-wind… | ||||
| CVE-2026-9751US | — | — | ||
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. | ||||
| CVE-2026-9750US | — | — | ||
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution.… | ||||
| CVE-2026-9749US | — | — | ||
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single k… | ||||
| CVE-2026-9748US | — | — | ||
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general p… | ||||
| CVE-2026-9747US | — | — | ||
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | ||||
| CVE-2026-9746US | — | — | ||
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges… | ||||
| CVE-2026-9743US | — | — | ||
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, th… | ||||
| CVE-2026-9742US | medium5.9 | — | ||
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The auth… | ||||
| CVE-2026-9741US | —OT elevated | — | ||
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for… | ||||
| CVE-2026-9740US | — | — | ||
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's ha… | ||||
| CVE-2026-9735US | — | — | ||
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full au… | ||||
02
references
External citations — patches, advisories, analysis.
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan