CVE-2026-104004
Received Received - Intake

MongoDB Server Collection Validation Denial of Service

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: MongoDB, Inc.

Description
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-104004
EUVD
EUVD-2026-98820

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
MongoDB MongoDB Server 8.3.0
MongoDB MongoDB Server 8.0
MongoDB MongoDB Server 9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves MongoDB Server's collection validation feature failing to handle certain expressions correctly. When a document is inserted later, it can cause the server process to crash. This issue affects authenticated users with write access.

Impact Analysis

If exploited, this vulnerability could lead to denial of service by crashing the MongoDB server. Users with write access could trigger server unavailability, disrupting database operations and applications relying on it.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions, leading to potential data unavailability. GDPR requires timely access to personal data, and HIPAA mandates continuous availability of healthcare data. Downtime may violate these regulations.

Mitigation Strategies

Update MongoDB Server to the latest patched version to address the collection validation issue. Ensure only authenticated users with necessary write access have permissions. Monitor server logs for unexpected process stops during document insertion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart