CVE Feed

    Dashboard / CVE / CVE-2026-9749

    CVE-2026-9749

    This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.

    Published:Jun 9, 2026
    Last Modified:Jun 10, 2026
    EPS:Jun 9, 2026
    EPSS Score:0.0004
    CVSS Score:6.5

    Affected Products

    Vendor
    Mongodb
    Product
    Mongodb Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-617 Reachable Assertion

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-82076 (CVSS 7.1) — An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ord…
    CVE-2026-82075 (CVSS 8.7) — An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-clust…
    CVE-2026-82074 (CVSS 7.1) — MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticate…
    CVE-2026-82073 (CVSS 7.1) — A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read pr…
    CVE-2026-82071 (CVSS 7.2) — Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user…
    CVE-2026-82070 (CVSS 7.1) — A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitori…
    CVE-2026-82069 (CVSS 5.1) — A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring…
    CVE-2026-82068 (CVSS 7.1) — A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent …
    CVE-2026-82067 (CVSS 9.2) — Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause th…
    CVE-2026-82066 (CVSS 5.3) — A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenti…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High