CVE-2026-9737
Received Received - Intake

Incorrect Query Planning Leading to Invariant Failure in MongoDB

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-9737
EUVD
EUVD-2026-47775

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs during query planning in MongoDB when processing raw BSON objects containing sort patterns. The system fails to properly handle meta expressions, leading to incorrect transformations that can cause an invariant failure.

Impact Analysis

This could lead to database crashes or unexpected behavior during query execution, potentially causing data unavailability or corruption. It may also allow unauthorized access if exploited through crafted queries.

Mitigation Strategies

Update MongoDB to the latest patched version to address the query planning issue in BSONObj handling. Monitor official MongoDB advisories for patches and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart