DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
MongoDB: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-06-09
Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-9754US | — | — | ||
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command | ||||
| CVE-2026-9753US | — | — | ||
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the serv… | ||||
| CVE-2026-9752US | — | — | ||
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-wind… | ||||
| CVE-2026-9751US | — | — | ||
The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. | ||||
| CVE-2026-9750US | — | — | ||
An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution.… | ||||
| CVE-2026-9749US | — | — | ||
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single k… | ||||
| CVE-2026-9748US | — | — | ||
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general p… | ||||
| CVE-2026-9747US | — | — | ||
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | ||||
| CVE-2026-9746US | — | — | ||
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges… | ||||
| CVE-2026-9743US | — | — | ||
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, th… | ||||
| CVE-2026-9742US | medium5.9 | — | ||
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The auth… | ||||
| CVE-2026-9741US | —OT erhöht | — | ||
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for… | ||||
| CVE-2026-9740US | — | — | ||
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's ha… | ||||
| CVE-2026-9735US | — | — | ||
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full au… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
- EU Vulnerability Database vom 2026-06-09external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan