MongoDB Pipeline PauseExecution Crash via Facet

Publication date: 2026-06-09

Last updated on: 2026-06-15

Assigner: MongoDB, Inc.

Description

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-15

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-9748

EUVD

EUVD-2026-35864

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 7.0.0 (inc) to 7.0.35 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.10 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.3 (exc)
mongodb	mongodb	From 8.0.0 (inc) to 8.0.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability involves the $_internalConvertBucketIndexStats stage in MongoDB, which uses PauseExecution as a signal to skip processing a document when an index stats conversion fails. However, PauseExecution is intended only as an internal signal used by the $facet stage to coordinate its sub-pipelines. When $_internalConvertBucketIndexStats is placed before $facet in a pipeline, $facet's internal TeeBuffer receives an unexpected PauseExecution signal from upstream, causing a hard invariant assertion failure that crashes the mongod process.

Impact Analysis

The primary impact of this vulnerability is that it can cause the mongod process to crash unexpectedly. This results in a denial of service condition, potentially disrupting database availability and operations.

Hi! I’m here to help you understand CVE-2026-9748. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70