Memory Manipulation Vulnerability in MongoDB Server

CVE-2026-96297

What is CVE-2026-96297?

The MongoDB Server has a vulnerability where, during the aggregation process, it may use freed memory. This occurs when an aggregation stage is executed with a batch size of 0, causing the server to attempt to read data from a memory area that has already been released. Consequently, this can lead to retrieving unrelated data, which may compromise the integrity of query results. Additionally, under certain conditions, this behavior can cause the server process to crash unexpectedly when executed by an authenticated user with appropriate read privileges. This vulnerability highlights the importance of proper memory management in database operations.

References