DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
MongoDB Server, Go Driver, Ruby Driver: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-02-10
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um beliebigen Ruby-Code auszuführen, die Autorisierung zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder nicht näher spezifizierte Auswirkungen zu verursachen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-2303US | — | — | ||
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulner… | ||||
| CVE-2026-2302US | — | — | ||
Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code. | ||||
| CVE-2026-25613US | — | — | ||
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. | ||||
| CVE-2026-25610US | — | — | ||
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | ||||
| CVE-2026-25609US | medium4.3OT erhöht | — | ||
Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. | ||||
| CVE-2026-1850US | high7.5 | — | ||
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. | ||||
| CVE-2026-1849US | high7.5 | — | ||
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server… | ||||
| CVE-2026-1848US | — | — | ||
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resource… | ||||
| CVE-2026-1847US | high7.5 | — | ||
Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside t… | ||||
| CVE-2026-25612US | — | — | ||
The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one… | ||||
| CVE-2026-25611US | — | — | ||
A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
- MongoDB Issue vom 2026-02-10external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan