CVE-2026-9749
Analyzed
Analyzed - Analysis Complete
MongoDB Aggregation Pipeline Key-Range Buffer Overflow
Vulnerability report for CVE-2026-9749, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-06-09
Last updated on: 2026-06-18
Assigner: MongoDB, Inc.
Description
Description
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | mongodb | From 8.0.0 (inc) to 8.0.24 (exc) |
| mongodb | mongodb | From 8.2.0 (inc) to 8.2.10 (exc) |
| mongodb | mongodb | From 8.3.0 (inc) to 8.3.3 (exc) |
| mongodb | mongodb | From 7.0.0 (inc) to 7.0.35 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
