QSearchQSearch

CVE-2026-9750

6.5 MEDIUM

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal ...

Published: 2026-06-09 · Last updated: 2026-06-09

Severity and scoring

CVSS
6.5 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-617

Description

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-46543 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (5.3 MEDIUM)
  • CVE-2026-46542 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (4.3 MEDIUM)
  • CVE-2026-9749 — This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning a... (6.5 MEDIUM)
  • CVE-2026-9748 — The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion fa... (6.5 MEDIUM)
  • CVE-2026-9747 — Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server (6.5 MEDIUM)