Behoben in
Version prüfen
mongod --versionCVEs, die 8.0 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2025-14847 | Zlib compressed protocol header length confusion may allow memory read | 8.7 | KEV | 83.2% | 2025-12-19 |
| CVE-2026-118383 | Pre-authentication use-after-free in MongoDB Server replica set primary catch-up | 9.5 | 0.7% | 2026-11-11 | |
| CVE-2026-13072 | MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption | 9.2 | — | 2026-07-23 | |
| CVE-2026-82067 | Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remai... | 9.2 | — | 2026-09-09 | |
| CVE-2026-18691 | Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure | 9.0 | — | 2026-08-12 | |
| CVE-2026-18697 | Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos | 8.7 | — | 2026-08-12 | |
| CVE-2026-82064 | Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replic... | 8.7 | — | 2026-09-09 | |
| CVE-2026-82075 | Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service | 8.7 | — | 2026-09-09 | |
| CVE-2026-4148 | ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators | 8.7 | — | 2026-03-18 | |
| CVE-2026-8053 | FlatBSON Duplicate Field Index Drift | 8.7 | — | 2026-05-13 | |
| CVE-2026-9740 | Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow | 8.7 | — | 2026-06-10 | |
| CVE-2026-11933 | Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion | 8.7 | — | 2026-06-12 | |
| CVE-2026-13059 | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass | 8.6 | — | 2026-07-23 | |
| CVE-2025-0755 | MongoDB C Driver bson library may be susceptible to buffer overflow | 8.4 | — | 2025-03-18 | |
| CVE-2026-1848 | Connections received from the proxy port may not count towards total accepted connections | 8.2 | — | 2026-02-11 | |
| CVE-2025-3085 | MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked | 8.1 | — | 2025-04-01 | |
| CVE-2026-18692 | Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Exec... | 7.7 | — | 2026-08-12 | |
| CVE-2026-89099 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption | 7.7 | — | 2026-09-12 | |
| CVE-2025-6713 | MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage | 7.7 | — | 2025-07-07 | |
| CVE-2026-82053 | Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment | 7.6 | — | 2026-09-09 | |
| CVE-2025-6709 | Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication | 7.5 | — | 2025-06-26 | |
| CVE-2025-6710 | Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in M... | 7.5 | — | 2025-06-26 | |
| CVE-2025-6714 | Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections | 7.5 | — | 2025-07-07 | |
| CVE-2026-13067 | tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket | 7.2 | — | 2026-07-23 | |
| CVE-2026-18690 | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections | 7.2 | — | 2026-08-12 | |
| CVE-2026-18693 | Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory... | 7.2 | — | 2026-08-12 | |
| CVE-2026-18712 | Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification... | 7.2 | — | 2026-08-12 | |
| CVE-2026-9753 | Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. | 7.2 | — | 2026-06-10 | |
| CVE-2026-13065 | MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination | 7.1 | — | 2026-07-23 | |
| CVE-2026-13066 | Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure | 7.1 | — | 2026-07-23 | |
| CVE-2026-13069 | Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion | 7.1 | — | 2026-07-23 | |
| CVE-2026-13071 | Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination | 7.1 | — | 2026-07-23 | |
| CVE-2026-13077 | Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data | 7.1 | — | 2026-07-23 | |
| CVE-2026-9737 | Find command with $meta sort can lead to crash | 7.1 | — | 2026-07-23 | |
| CVE-2026-18687 | Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index... | 7.1 | — | 2026-08-12 | |
| CVE-2026-18688 | Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure | 7.1 | — | 2026-08-12 | |
| CVE-2026-18694 | Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disc... | 7.1 | — | 2026-08-12 | |
| CVE-2026-18695 | Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service | 7.1 | — | 2026-08-12 | |
| CVE-2026-18701 | Type Confusion in MongoDB Query Subsystem Leads to Denial of Service | 7.1 | — | 2026-08-12 | |
| CVE-2026-18705 | Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data | 7.1 | — | 2026-08-12 | |
| CVE-2026-18711 | Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure | 7.1 | — | 2026-08-12 | |
| CVE-2026-82052 | $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars | 7.1 | — | 2026-09-09 | |
| CVE-2026-82054 | Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service | 7.1 | — | 2026-09-09 | |
| CVE-2026-82058 | Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service | 7.1 | — | 2026-09-09 | |
| CVE-2026-82065 | Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Servi... | 7.1 | — | 2026-09-09 | |
| CVE-2026-82068 | Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Ser... | 7.1 | — | 2026-09-09 | |
| CVE-2026-82070 | Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface | 7.1 | — | 2026-09-09 | |
| CVE-2026-82074 | Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection... | 7.1 | — | 2026-09-09 | |
| CVE-2026-82076 | Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server | 7.1 | — | 2026-09-09 | |
| CVE-2025-13507 | Time-series operations may cause internal BSON size limit to be exceed | 7.1 | — | 2025-11-25 | |
| CVE-2025-13644 | MongoDB may be susceptible to Invariant Failure due to batched delete | 7.1 | — | 2025-11-25 | |
| CVE-2026-1847 | MongoDB Server may crash when inserting large documents | 7.1 | — | 2026-02-11 | |
| CVE-2026-1849 | Mongod can run out of stack memory when expressions create deeply nested documents | 7.1 | — | 2026-02-11 | |
| CVE-2026-1850 | An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean ex... | 7.1 | — | 2026-02-11 | |
| CVE-2026-25610 | Invalid $geoNear index hint may cause server crash | 7.1 | — | 2026-02-11 | |
| CVE-2026-25613 | An unsafe cast in the MongoDB query planner can result in a segmentation fault. | 7.1 | — | 2026-02-11 | |
| CVE-2026-4147 | Stack memory disclosure in filemd5 command | 7.1 | — | 2026-03-18 | |
| CVE-2026-6914 | MD5 checksum creation may cause availability loss | 7.1 | — | 2026-04-30 | |
| CVE-2026-8199 | Post-auth memory exhaustion via bitwise match expressions | 7.1 | — | 2026-05-13 | |
| CVE-2026-8843 | Calling createIndex with certain index types can crash mongod | 7.1 | — | 2026-05-19 | |
| CVE-2026-9741 | Client side encryption fails to encrypt values in a $vectorSearch | 7.1 | — | 2026-06-10 | |
| CVE-2026-9743 | Aggregation sub-pipeline null dereference may allow DoS via crafted getMore | 7.1 | — | 2026-06-10 | |
| CVE-2026-9746 | Server crashes in case of the use of exchange | 7.1 | — | 2026-06-10 | |
| CVE-2026-9747 | Crafted cross-shard merge aggregation crashes MongoDB Server | 7.1 | — | 2026-06-10 | |
| CVE-2026-9748 | $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input | 7.1 | — | 2026-06-10 | |
| CVE-2026-9749 | Using MaxKey() may crash the server | 7.1 | — | 2026-06-10 | |
| CVE-2026-9750 | Metadata name collision on $-prefixed fields causes post-auth server crash | 7.1 | — | 2026-06-10 | |
| CVE-2026-9752 | GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation | 7.1 | — | 2026-06-10 | |
| CVE-2026-13055 | Server crash via aggregation pipeline expression with compound wildcard index specification | 7.1 | — | 2026-07-23 | |
| CVE-2026-13056 | A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of... | 7.1 | — | 2026-07-23 | |
| CVE-2026-13058 | Transaction Command Insufficient Input Validation Leading to Process Termination | 7.1 | — | 2026-07-23 | |
| CVE-2026-13060 | $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access | 7.1 | — | 2026-07-23 | |
| CVE-2026-13062 | MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Cluster... | 7.1 | — | 2026-07-23 | |
| CVE-2026-13064 | MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service | 7.1 | — | 2026-07-23 | |
| CVE-2026-18696 | Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections | 7.0 | — | 2026-08-12 | |
| CVE-2026-13074 | Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service | 6.9 | — | 2026-07-23 | |
| CVE-2024-10921 | Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server | 6.8 | — | 2024-11-15 | |
| CVE-2026-9751 | Sensitive data could be written to mongod.log | 6.8 | — | 2026-06-10 | |
| CVE-2025-3084 | MongoDB Server may crash due to improper validation of explain command | 6.5 | — | 2025-04-01 | |
| CVE-2025-6712 | MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation | 6.5 | — | 2025-07-07 | |
| CVE-2025-10059 | MongoDB Server router will crash when incorrect lsid is set on a sharded query | 6.5 | — | 2025-09-06 | |
| CVE-2025-10060 | MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation | 6.5 | — | 2025-09-06 | |
| CVE-2025-10061 | Malformed $group Query May Cause MongoDB Server to Crash | 6.5 | — | 2025-09-06 | |
| CVE-2026-13078 | Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader | 6.3 | — | 2026-07-23 | |
| CVE-2026-4358 | Memory safety issues in slot-based execution hash table spill | 6.1 | — | 2026-03-18 | |
| CVE-2026-8201 | Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields | 6.1 | — | 2026-05-13 | |
| CVE-2026-13070 | Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination | 6.0 | — | 2026-07-23 | |
| CVE-2026-18699 | Improper Input Validation in MongoDB Query Planner Leads to Denial of Service | 6.0 | — | 2026-08-12 | |
| CVE-2026-18700 | Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service | 6.0 | — | 2026-08-12 | |
| CVE-2026-82056 | Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service | 6.0 | — | 2026-09-09 | |
| CVE-2026-82059 | Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure an... | 6.0 | — | 2026-09-09 | |
| CVE-2026-82063 | Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service | 6.0 | — | 2026-09-09 | |
| CVE-2026-5170 | Users could trigger a crash of mongod primaries during promotion to sharded | 6.0 | — | 2026-03-31 | |
| CVE-2026-13057 | Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$... | 6.0 | — | 2026-07-23 | |
| CVE-2026-18709 | Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsist... | 5.9 | — | 2026-08-12 | |
| CVE-2025-12657 | Malformed KMIP response may result in access violation | 5.9 | — | 2025-11-04 | |
| CVE-2026-13073 | MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination | 5.3 | — | 2026-07-23 | |
| CVE-2026-18698 | Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Co... | 5.3 | — | 2026-08-12 | |
| CVE-2026-18702 | Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic S... | 5.3 | — | 2026-08-12 | |
| CVE-2026-18707 | Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service | 5.3 | — | 2026-08-12 | |
| CVE-2026-18708 | Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Ex... | 5.3 | — | 2026-08-12 | |
| CVE-2026-82066 | Heap Out-of-Bounds Read in MongoDB Server Query Planning Component | 5.3 | — | 2026-09-09 | |
| CVE-2025-11979 | Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior | 5.3 | — | 2025-10-21 | |
| CVE-2026-25609 | profile command may permit unauthorized configuration | 5.3 | — | 2026-02-11 | |
| CVE-2026-6915 | Flaw in the updateUser Command May Allow Unauthorized Configuration Change | 5.3 | — | 2026-04-30 | |
| CVE-2026-8202 | Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators | 5.3 | — | 2026-05-13 | |
| CVE-2026-13061 | Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage | 5.3 | — | 2026-07-23 | |
| CVE-2025-6706 | Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server | 5.0 | — | 2025-06-26 | |
| CVE-2026-8200 | Schema validation log messages may not redact user data | 4.8 | — | 2026-05-13 | |
| CVE-2025-6711 | Incomplete Redaction of Sensitive Information in MongoDB Server Logs | 4.4 | — | 2025-07-07 | |
| CVE-2025-6707 | Race condition in privilege cache invalidation cycle | 4.2 | — | 2025-06-26 | |
| CVE-2026-13068 | MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse | 2.3 | — | 2026-07-23 | |
| CVE-2026-82060 | Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stre... | 2.3 | — | 2026-09-09 | |
| CVE-2025-12893 | Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields... | 2.3 | — | 2025-11-25 | |
| CVE-2025-13643 | MongoDB Server may allow queries to be terminated by unauthorized users | 2.3 | — | 2025-11-25 | |
| CVE-2025-14345 | Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server | 2.3 | — | 2025-12-10 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).