CVE-2026-9743

Name of the Vulnerable Software and Affected Versions MongoDB Server version 8.0

Description An aggregation stage can leave its subPipeline field null during the processing of specific pipelines. If a getMore command is subsequently issued on the same cursor, the server may dereference this null sub-pipeline while reattaching to the operation context, leading to an invalid address access and a process crash. This allows an authenticated user with permissions to run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by a getMore request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.