CVE-2026-9743

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-123688	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) En el servidor MongoDB 8.0, una etapa de agregación puede dejar su campo _subPipeline nulo durante el procesamiento de ciertas canalizaciones. Si posteriormente se emite un getMore en el mismo cursor, el servidor puede desreferenciar esta sub-canalización nula al volver a adjuntarse al contexto de la operación, accediendo a una dirección inválida y bloqueando el proceso. Este problema permite a un usuario autenticado que puede ejecutar canalizaciones de agregación causar una denegación de servicio al emitir una agregación especialmente diseñada seguida de un getMore en las versiones afectadas.

15 Jun 2026, 16:56

Type	Values Removed	Values Added
References	~~() https://jira.mongodb.org/browse/SERVER-123688 -~~	() https://jira.mongodb.org/browse/SERVER-123688 - Vendor Advisory
First Time		Mongodb mongodb Mongodb
CPE		cpe:2.3:a:mongodb:mongodb::::::::

09 Jun 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 23:17

Updated : 2026-07-23 09:10

NVD link : CVE-2026-9743

Mitre link : CVE-2026-9743

CVE.ORG link : CVE-2026-9743

JSON object : View

Products Affected

mongodb

mongodb

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-9743", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9743", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T13:50:38.997985Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB", "product": "MongoDB server", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.24", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T23:17:03.853", "references": [{"url": "https://jira.mongodb.org/browse/SERVER-123688", "tags": ["Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions."}, {"lang": "es", "value": "En el servidor MongoDB 8.0, una etapa de agregaci\u00f3n puede dejar su campo _subPipeline nulo durante el procesamiento de ciertas canalizaciones. Si posteriormente se emite un getMore en el mismo cursor, el servidor puede desreferenciar esta sub-canalizaci\u00f3n nula al volver a adjuntarse al contexto de la operaci\u00f3n, accediendo a una direcci\u00f3n inv\u00e1lida y bloqueando el proceso. Este problema permite a un usuario autenticado que puede ejecutar canalizaciones de agregaci\u00f3n causar una denegaci\u00f3n de servicio al emitir una agregaci\u00f3n especialmente dise\u00f1ada seguida de un getMore en las versiones afectadas."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2769E44F-AA84-4942-BC40-AEA0E84BFBA5", "versionEndExcluding": "8.0.24", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}