CVE-2026-96299

Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in MongoDB Server via Nested Aggregation

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: MongoDB, Inc.

Description

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96299

EUVD

EUVD-2026-98812

Affected Vendors & Products

Vendor	Product	Version / Range
MongoDB	MongoDB	Server 8.3.0
MongoDB	MongoDB	Server 9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB mongos allows an authenticated user with readWrite privileges to crash the mongos process by sending a specially crafted aggregation pipeline. The issue involves an internal aggregation stage that bypasses authorization checks, forcing an unstable execution path that triggers a fatal error and causes the mongos process to abort, leading to a denial of service for all clients using that instance.

Detection Guidance

This vulnerability can be detected by monitoring for unexpected crashes in mongos processes. Check MongoDB logs for fatal errors or segmentation faults related to aggregation pipelines. Ensure no unauthorized users have readWrite privileges and validate aggregation pipeline stages for suspicious internal stages.

Impact Analysis

If exploited, this vulnerability can disrupt database operations by crashing the mongos router, which handles all client requests in a sharded cluster. This results in downtime for all users and applications relying on the affected MongoDB instance, potentially causing data unavailability and service interruptions.

Compliance Impact

This vulnerability causes a denial of service by crashing the mongos process, which could disrupt access to data. For GDPR, this may impact availability of personal data processing. For HIPAA, it could interrupt access to protected health information, potentially violating access controls and availability requirements.

Mitigation Strategies

Immediately update MongoDB to the latest patched version to address the aggregation pipeline authorization flaw. Restrict readWrite privileges to only necessary users and monitor mongos processes for unexpected crashes.

Hi! I’m here to help you understand CVE-2026-96299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70