Skip to content
OpenAdvisories
Medium WID-SEC-2026-0386 11 CVEs

MongoDB Server, Go Driver, Ruby Driver: Mehrere Schwachstellen

Published Feb 10, 2026 · Updated Oct 18, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: openSUSE Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um beliebigen Ruby-Code auszuführen, die Autorisierung zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder nicht näher spezifizierte Auswirkungen zu verursachen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 11

  • High 7.5
    CVE-2026-1848

    Connections received from the proxy port may not count towards total accepted connections

    Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the p…

    MongoDB MongoDB Server
  • High 7.5
    CVE-2026-25611

    Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server

    A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-1847

    MongoDB Server may crash when inserting large documents

    Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-1849

    Mongod can run out of stack memory when expressions create deeply nested documents

    MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-1850

    An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

    Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-2302

    Unsafe Reflection in Mongoid::Criteria.from_hash

    Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

    MongoDB MongoDB Ruby Driver ruby-mongo Ubuntu
  • Medium 6.5
    CVE-2026-2303

    Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

    The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI sta…

    MongoDB MongoDB Go Driver kubescape kubeflow-pipelines-apiserver Azure Linux Wolfi Go
  • Medium 6.5
    CVE-2026-25610

    Invalid $geoNear index hint may cause server crash

    An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-25612

    Internal ResourceId collision may affect unrelated collections

    The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conf…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-25613

    An unsafe cast in the MongoDB query planner can result in a segmentation fault.

    An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 5.4
    CVE-2026-25609

    profile command may permit unauthorized configuration

    Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

    MongoDB MongoDB Server

Revision history

  1. #3

    Neue Updates von openSUSE aufgenommen

  2. #2

    Neue Updates von openSUSE aufgenommen

  3. #1

    Initiale Fassung

References