Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service

Server crash via aggregation pipeline expression with compound wildcard index specification

A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

Transaction Command Insufficient Input Validation Leading to Process Termination

Find command with $meta sort can lead to crash

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

libmongocrypt Improper Input Validation Leading to Process Termination

MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination

$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

Aggregation Framework Memory Exhaustion Leading to Process Termination

Stack memory disclosure in filemd5 command

GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

Metadata name collision on $-prefixed fields causes post-auth server crash

Using MaxKey() may crash the server

$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

Crafted cross-shard merge aggregation crashes MongoDB Server

Server crashes in case of the use of exchange

Aggregation sub-pipeline null dereference may allow DoS via crafted getMore

Client side encryption fails to encrypt values in a $vectorSearch

Calling createIndex with certain index types can crash mongod

Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

Post-auth memory exhaustion via bitwise match expressions

Post-auth null pointer dereference when aggregating against a view with empty search pipeline

An unsafe cast in the MongoDB query planner can result in a segmentation fault.

Invalid $geoNear index hint may cause server crash

Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure

MongoDB Server may allow queries to be terminated by unauthorized users

Time-series operations may cause internal BSON size limit to be exceed

Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior

Malformed $group Query May Cause MongoDB Server to Crash

MongoDB Server router will crash when incorrect lsid is set on a sharded query

Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash

MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation

MongoDB Server may crash due to improper validation of explain command

MongoDB Server secondaries may crash due to forced index constraints

Missing authorization check may lead to shard key refinement

An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service…

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard

A user authorized to performing a specific type of find query may trigger a denial of service

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining…