Denial of Service in MongoDB Server 8.0 Affecting Aggregation Pipelines

CVE-2026-9743

What is CVE-2026-9743?

In MongoDB Server 8.0, a flaw in the processing of aggregation stages may result in a null value in the _subPipeline field during certain operations. If a subsequent getMore command is executed on the same cursor after such a pipeline, the server encounters a dereference of this null value, potentially leading to a crash. This vulnerability enables authenticated users capable of running aggregation pipelines to trigger a denial of service by crafting specific aggregate queries, thus jeopardizing service availability.

References