A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

Transaction Command Insufficient Input Validation Leading to Process Termination

Find command with $meta sort can lead to crash

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

libmongocrypt Improper Input Validation Leading to Process Termination

MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination

$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

Aggregation Framework Memory Exhaustion Leading to Process Termination

Stack memory disclosure in filemd5 command

GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

Metadata name collision on $-prefixed fields causes post-auth server crash

Using MaxKey() may crash the server

$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

Crafted cross-shard merge aggregation crashes MongoDB Server

Server crashes in case of the use of exchange

Aggregation sub-pipeline null dereference may allow DoS via crafted getMore

Client side encryption fails to encrypt values in a $vectorSearch

Calling createIndex with certain index types can crash mongod

Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

Post-auth memory exhaustion via bitwise match expressions

Post-auth null pointer dereference when aggregating against a view with empty search pipeline

An unsafe cast in the MongoDB query planner can result in a segmentation fault.

Invalid $geoNear index hint may cause server crash

Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure

MongoDB Server may allow queries to be terminated by unauthorized users

Time-series operations may cause internal BSON size limit to be exceed

Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers

An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in…

MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash

When run on commands with certain arguments set, explain may fail to validate these arguments before using them

prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing…

A command for refining a collection shard key is missing an authorization check

An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service…

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard

A user authorized to performing a specific type of find query may trigger a denial of service

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining…

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations