CVE-2026-6914
Received Received - Intake
Denial of Service in MongoDB Server

Publication date: 2026-04-29

Last updated on: 2026-05-06

Assigner: MongoDB, Inc.

Description
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-29
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-04-30
EPSS Evaluated
2026-06-15
NVD
CVE-2026-6914
EUVD
EUVD-2026-26262
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
mongodb mongodb From 7.0.0 (inc) to 7.0.32 (exc)
mongodb mongodb From 8.0.0 (inc) to 8.0.21 (exc)
mongodb mongodb From 8.1.0 (inc) to 8.2.7 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs when the MongoDB server computes the MD5 checksum of a malformed BSON object under specific conditions. This process may cause the server to lose availability, meaning it could crash or become unresponsive.

Impact Analysis

The impact of this vulnerability is a loss of availability of the MongoDB server. This means that an attacker could potentially cause the server to crash or become unavailable, disrupting services that rely on the database.

Executive Summary

This vulnerability occurs when the MongoDB server computes the MD5 checksum of a malformed BSON object under certain conditions. This process can cause the server to lose availability, meaning it may crash or become unresponsive.

Impact Analysis

The impact of this vulnerability is a loss of availability of the MongoDB server. This means that an attacker could potentially cause the server to crash or become unavailable, disrupting services that rely on the database.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6914. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart