CVE-2026-104004
CVE-2026-104004 · Collection validators using collation-accepting expressions can crash MongoDB Server on insert
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
mongodb server
- Versions
- ≥ 8.3.0, < 8.3.13: Affected (semver)
- ≥ 8.0, < 8.0.34: Affected (semver)
- ≥ 9.0, < 9.0.4: Affected (semver)
Update to 8.0.34; Update to 8.3.13; Update to 9.0.4
mongodb Ubuntu:Pro:14.04:LTS
- Versions
- 1:2.4.6-0ubuntu5
- 1:2.4.6-0ubuntu6
- 1:2.4.8-1ubuntu1
- 1:2.4.8-2
- 1:2.4.9-1
- 1:2.4.9-1ubuntu1
- 1:2.4.9-1ubuntu2
- 1:2.4.9-1ubuntu2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mongodb Ubuntu:Pro:16.04:LTS
- Versions
- 1:2.6.10-0ubuntu1
- 1:2.6.10-0ubuntu1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mongodb Ubuntu:Pro:18.04:LTS
- Versions
- 1:3.4.7-1
- 1:3.4.7-1ubuntu1
- 1:3.4.7-1ubuntu2
- 1:3.4.7-1ubuntu4
- 1:3.4.14-3ubuntu1
- 1:3.4.14-3ubuntu2
- 1:3.6.3-0ubuntu1
- 1:3.6.3-0ubuntu1.1
- 1:3.6.3-0ubuntu1.3
- 1:3.6.3-0ubuntu1.4
- 1:3.6.3-0ubuntu1.4+esm1
- 1:3.6.3-0ubuntu1.4+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mongodb Ubuntu:Pro:20.04:LTS
- Versions
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published