QSearchQSearch

CVE-2026-9748

6.5 MEDIUM

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion fa...

Published: 2026-06-09 · Last updated: 2026-06-09

Severity and scoring

CVSS
6.5 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-617

Description

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-46543 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (5.3 MEDIUM)
  • CVE-2026-46542 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (4.3 MEDIUM)
  • CVE-2026-9750 — An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal ... (6.5 MEDIUM)
  • CVE-2026-9749 — This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning a... (6.5 MEDIUM)
  • CVE-2026-9747 — Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server (6.5 MEDIUM)