Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with…

Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution

BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

Update operator injection via single-element list rewriting in the update builder

NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

Collection validators using collation-accepting expressions can crash MongoDB Server on insert

Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings

Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt

Connection redirection via percent-encoded delimiter injection in connection string hosts

Heap buffer overflow via mid-scan command list growth in client topology monitoring

Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel

Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver

Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service

Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata

Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service

Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service

Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service

$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data

Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

Improper Input Validation in MongoDB Query Planner Leads to Denial of Service

Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections

Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

Type Confusion in MongoDB Query Subsystem Leads to Denial of Service

Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data

Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service

Server crash via aggregation pipeline expression with compound wildcard index specification

A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

Transaction Command Insufficient Input Validation Leading to Process Termination

Find command with $meta sort can lead to crash