CVE-2026-9748

EUVD-2026-35864

09.06.2026, 23:17

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mongodb	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 18%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
mongodb	mongodb	8.3.0 ≤ 𝑥 < 8.3.3	CNA
mongodb	mongodb	8.2.0 ≤ 𝑥 < 8.2.10	CNA
mongodb	mongodb	8.0.0 ≤ 𝑥 < 8.0.10	CNA
mongodb	mongodb	7.0.0 ≤ 𝑥 < 7.0.35	CNA

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Vulnerability Media Exposure

[GERMAN] MongoDB: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.
Published: 2026-06-09T22:00:00+00:00

References

https://jira.mongodb.org/browse/SERVER-123951