CVE-2026-9740
Analyzed
Analyzed - Analysis Complete
MongoDB Server BSON Validation Recursion Denial of Service
Vulnerability report for CVE-2026-9740, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-06-09
Last updated on: 2026-06-15
Assigner: MongoDB, Inc.
Description
Description
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | mongodb | From 7.0.0 (inc) to 7.0.35 (exc) |
| mongodb | mongodb | From 8.0.0 (inc) to 8.0.24 (exc) |
| mongodb | mongodb | From 8.2.0 (inc) to 8.2.10 (exc) |
| mongodb | mongodb | From 8.3.0 (inc) to 8.3.3 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
