MongoDBCVE-2026-9737
MongoDB Server: reachable assertion
High7.1CVE-2026-9737 · Published Jul 22, 2026 · updated Jul 23, 2026
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB Server Product | >= 7.0, < 7.0.39 | 7.0.39 |
| >= 8.0, < 8.0.28 | 8.0.28 | |
| >= 8.2.0, < 8.2.12 | 8.2.12 | |
| >= 8.3.0, < 8.3.7 | 8.3.7 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-617
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | MongoDB Compass: command injection | High8.4 | 1.49.7 |
| Jul 22 | MongoDB Server: resource exhaustion | Medium6.9 | 7.0.39+3 more |
| Jul 22 | MongoDB Server: resource exhaustion | High7.1 | 8.2.12+1 more |
| Jul 22 | MongoDB Server: resource exhaustion | High7.1 | 8.3.7 |
| Jul 22 | MongoDB Server: out-of-bounds read | High7.1 | 7.0.39+3 more |
| Jul 22 | MongoDB Server: missing authorization | Medium6.3 | 7.0.39+3 more |