CVE-2026-9753

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

Score

CVSS 3.1 8.1 High

Status

Analyzed - cna@mongodb.com

Published

2026-06-09

Last modified

2026-06-10

Weaknesses

CWE-1287, CWE-787

Affected products

• Mongodb (Mongodb)
• Mongodb Server (Mongodb)

References

• https://jira.mongodb.org/browse/SERVER-124959