Description
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MongoDB | MongoDB Server | 7.0 – < 7.0.32, 8.0 – < 8.0.21, 8.2 – < 8.2.6 | 7.0.32 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | mongodb | No fix yet | — |
| Ubuntu Pro 18.04 LTS | mongodb | No fix yet | — |
| Ubuntu Pro 16.04 LTS | mongodb | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | mongodb | No fix yet | — |
Advisories 1
- WID-SEC-2026-1581 MongoDB: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 18, 2026
References
- https://jira.mongodb.org/browse/SERVER-116327 issue-tracking