Description

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T19:17:24.270Z",
  "pubdate": "2026-08-11T19:17:24.270Z",
  "executiveSummary": "An availability vulnerability exists in the MongoDB Server query planner component. The flaw allows an authenticated adversary with read-level privileges to induce an unexpected termination of the database server process, leading to a direct denial of service.\nThe affected product is MongoDB Server, specifically impacting processing mechanisms associated with text indexes. Successful exploitation disrupts service availability for all connected clients and causes the abrupt termination of active in-flight operations.\nThe attack vector requires user authentication and read-level privileges within the database environment. The attacker must submit a specially crafted and malformed query targeting a collection containing a text index.\nThe risk implications are significant in terms of operational availability, as repeatable crashes can cause extended service outages. No remote code execution or privilege escalation capabilities are conferred by this specific vulnerability; the impact is strictly confined to service disruption through process termination.",
  "technicalDetails": "The root cause of the vulnerability resides within the query planner subsystem of MongoDB Server, specifically in how it processes and evaluates queries executed against collections configured with a text index.\nThe vulnerable component is the query optimization and planning engine. When an authenticated user submits a specially formulated query designed to exploit parsing or evaluation logic flaws within text index handling, the engine fails to safely process the input structures.\nAuthentication requirements dictate that the attacker must possess valid credentials and sufficient read-level privileges to interact with the targeted collection. The attack surface is exposed wherever user-submitted queries can be processed against text-indexed collections.\nThe attack flow proceeds as follows: First, the authenticated user authenticates to the MongoDB instance with read privileges. Second, the user crafts a malicious query incorporating specific parameters designed to trigger the flaw during the query planning phase. Third, the user submits this payload against a database collection containing a text index. Fourth, as the query planner attempts to evaluate and optimize the malformed query structure, an unhandled exception or critical assertion failure occurs within the server process. Finally, the MongoDB Server process encounters the fatal error and terminates unexpectedly, resulting in a denial of service for all connected clients and the immediate drop of in-flight operations."
}