CVE-2026-6914
Denial of Service in MongoDB Server
Publication date: 2026-04-29
Last updated on: 2026-05-06
Assigner: MongoDB, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | mongodb | From 7.0.0 (inc) to 7.0.32 (exc) |
| mongodb | mongodb | From 8.0.0 (inc) to 8.0.21 (exc) |
| mongodb | mongodb | From 8.1.0 (inc) to 8.2.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when the MongoDB server computes the MD5 checksum of a malformed BSON object under certain conditions. This process can cause the server to lose availability, meaning it may crash or become unresponsive.
How can this vulnerability impact me? :
The impact of this vulnerability is a loss of availability of the MongoDB server. This means that an attacker could potentially cause the server to crash or become unavailable, disrupting services that rely on the database.
Can you explain this vulnerability to me?
This vulnerability occurs when the MongoDB server computes the MD5 checksum of a malformed BSON object under specific conditions. This process may cause the server to lose availability, meaning it could crash or become unresponsive.
How can this vulnerability impact me? :
The impact of this vulnerability is a loss of availability of the MongoDB server. This means that an attacker could potentially cause the server to crash or become unavailable, disrupting services that rely on the database.