CVE-2026-9753
EUVD-2026-3585209.06.2026, 23:17
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mongodb | mongodb | 𝑥 < 7.0.35 |
| mongodb | mongodb | 8.0.0 ≤ 𝑥 < 8.0.24 |
| mongodb | mongodb | 8.2.0 ≤ 𝑥 < 8.2.10 |
| mongodb | mongodb | 8.3.0 ≤ 𝑥 < 8.3.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-1287 - Improper Validation of Specified Type of InputThe product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.