MongoDB Server
- Software type
- Other
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/13/2026, MongoDB Server recorded 0 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of MongoDB Server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-8843Calling createIndex with certain index types can crash mongodCVE-2026-8336Post-authentication use-after-free error in $_internalJsEmit and mapreduce commandsCVE-2026-8202Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsCVE-2026-8201Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted FieldsCVE-2026-8200Schema validation log messages may not redact user data| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-8843Calling createIndex with certain index types can crash mongod | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-8336Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-8202Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-8201Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-8200Schema validation log messages may not redact user data | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-8199Post-auth memory exhaustion via bitwise match expressions | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-8053FlatBSON Duplicate Field Index Drift | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-8063Post-auth null pointer dereference when aggregating against a view with empty search pipeline | Exploitation statusNot exploited | FixYes | Published05/07/2026 | SeverityHigh |
|---|
CVE-2025-14847Zlib compressed protocol header length confusion may allow memory read | Exploitation statusKEV | FixYes | Published12/19/2025 | SeverityHigh |
|---|
CVE-2025-14345Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityLow |
|---|
CVE-2025-13644MongoDB may be susceptible to Invariant Failure due to batched delete | Exploitation statusNot exploited | FixYes | Published11/25/2025 | SeverityHigh |
|---|
CVE-2025-13643MongoDB Server may allow queries to be terminated by unauthorized users | Exploitation statusNot exploited | FixYes | Published11/25/2025 | SeverityLow |
|---|
CVE-2025-13507Time-series operations may cause internal BSON size limit to be exceed | Exploitation statusNot exploited | FixYes | Published11/25/2025 | SeverityHigh |
|---|
CVE-2025-12893Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server | Exploitation statusNot exploited | FixYes | Published11/25/2025 | SeverityLow |
|---|
CVE-2025-12657Malformed KMIP response may result in access violation | Exploitation statusNot exploited | FixYes | Published11/03/2025 | SeverityMedium |
|---|
CVE-2022-24272MongoDB Server (mongod) may crash in response to unexpected requests | Exploitation statusNot confirmed | FixNo | Published04/21/2022 | SeverityMedium |
|---|
CVE-2021-32040Large aggregation pipelines with a specific stage can crash mongod under default configuration | Exploitation statusNot exploited | FixYes | Published04/12/2022 | SeverityMedium |
|---|
CVE-2021-32036Denial of Service and Data Integrity vulnerability in features command | Exploitation statusNot exploited | FixYes | Published02/04/2022 | SeverityMedium |
|---|
CVE-2021-20330Specific replication command with malformed oplog entries can crash secondaries | Exploitation statusNot exploited | FixYes | Published12/15/2021 | SeverityMedium |
|---|
CVE-2021-32037User may trigger invariant when allowed to send commands directly to shards | Exploitation statusNot exploited | FixYes | Published11/24/2021 | SeverityMedium |
|---|
CVE-2021-20333Server log entry spoofing via newline injection | Exploitation statusNot confirmed | FixYes | Published07/23/2021 | SeverityMedium |
|---|
CVE-2021-20326Specially crafted query may result in a denial of service of mongod | Exploitation statusNot exploited | FixYes | Published04/30/2021 | SeverityMedium |
|---|
CVE-2020-7929Specially crafted regex query can cause DoS | Exploitation statusNot exploited | FixYes | Published03/01/2021 | SeverityMedium |
|---|
CVE-2018-25004Invariant failure when explaining a find with a UUID | Exploitation statusNot exploited | FixYes | Published03/01/2021 | SeverityMedium |
|---|
CVE-2019-20925Denial of service via malformed network packet | Exploitation statusNot confirmed | FixYes | Published11/24/2020 | SeverityHigh |
|---|
CVE-2020-7928Improper neutralization of null byte leads to read overrun | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2020-7926Specific query can cause a DoS against MongoDB Server | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2020-7925Denial of Service when processing malformed Role names | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityHigh |
|---|
CVE-2019-2393Crash while joining collections with $lookup | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2019-2392$mod can result in undefined behavior | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2019-20924Invariant in IndexBoundsBuilder | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2019-20923Crash while handling internal Javascript exception types | Exploitation statusNot exploited | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20805Invariant with $elemMatch | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20804Invariant failure in applyOps | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20803Infinite loop in aggregation expression | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2018-20802Post-auth queries on compound index may crash mongod | Exploitation statusNot confirmed | FixYes | Published11/23/2020 | SeverityMedium |
|---|
CVE-2020-7923Specific GeoQuery can cause DoS against MongoDB Server | Exploitation statusNot exploited | FixYes | Published08/21/2020 | SeverityMedium |
|---|
CVE-2020-7921Administrative action may disable enforcement of per-user IP whitelisting | Exploitation statusNot exploited | FixYes | Published05/06/2020 | SeverityMedium |
|---|
CVE-2019-2390Code execution on Windows via OpenSSL engine injection | Exploitation statusNot confirmed | FixYes | Published08/30/2019 | SeverityHigh |
|---|
CVE-2019-2389Process termination via PID file manipulation | Exploitation statusNot confirmed | FixYes | Published08/30/2019 | SeverityMedium |
|---|
CVE-2019-2386Authorization session conflation | Exploitation statusNot confirmed | FixYes | Published08/06/2019 | SeverityHigh |
|---|
41 Results | Page 1 of 1