Zlib compressed protocol header length confusion may allow memory read

MongoDB Server may allow successful untrusted connection

Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

FlatBSON Duplicate Field Index Drift

ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

Memory safety issues in slot-based execution hash table spill

Mongod can run out of stack memory when expressions create deeply nested documents

An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

Connections received from the proxy port may not count towards total accepted connections

MongoDB Server may crash when inserting large documents

Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server

MongoDB may be susceptible to Invariant Failure due to batched delete

MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation

MongoDB C Driver bson library may be susceptible to buffer overflow

Calling createIndex with certain index types can crash mongod

Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

Post-auth memory exhaustion via bitwise match expressions

Post-auth null pointer dereference when aggregating against a view with empty search pipeline

An unsafe cast in the MongoDB query planner can result in a segmentation fault.

Invalid $geoNear index hint may cause server crash

Internal ResourceId collision may affect unrelated collections

MongoDB Server may allow queries to be terminated by unauthorized users

Time-series operations may cause internal BSON size limit to be exceed

Malformed $group Query May Cause MongoDB Server to Crash

MongoDB Server router will crash when incorrect lsid is set on a sharded query

Malformed KMIP response may result in access violation

Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

Schema validation log messages may not redact user data

Stack memory disclosure in filemd5 command

profile command may permit unauthorized configuration