Description
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.
Published: 2026-10-13
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The flaw is a use‑after‑free bug in MongoDB Server’s aggregation engine. When an internal aggregation stage named $_internalApplyOplogUpdate is combined with a batchSize value of zero, the server may read from memory that has already been freed. The data returned to the client can contain arbitrary information that was present in that memory before it was reused, and the server process can terminate unexpectedly, causing a denial of service. This problem exposes sensitive data from the database process and can disrupt service availability.

Affected Systems

The vulnerability affects MongoDB Server. No specific product version information is provided in the CNA data, so all installations of MongoDB Server at the time of discovery may be impacted until a patch is deployed.

Risk and Exploitability

The CVSS score is 6, indicating a medium impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated users with read privileges, as they need to execute an aggregate command that configures a batchSize of zero and includes the internal stage. The Likely attack vector is an authenticated remote user who can craft an aggregation query. Eventual exploitation can lead to data exposure and, in some circumstances, a crash of the database service.

Generated by OpenCVE AI on October 13, 2026 at 16:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for and apply the latest MongoDB Server patch that addresses the use‑after‑free issue.
  • Restrict authenticated read‑only users from executing aggregate commands that include batchSize 0 or the internal $_internalApplyOplogUpdate stage through role or policy changes.
  • Audit and monitor server logs for abnormal aggregation command usage and enforce stricter admission controls for internal aggregation stages.

Generated by OpenCVE AI on October 13, 2026 at 16:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Mongodb
Mongodb mongodb Server
Vendors & Products Mongodb
Mongodb mongodb Server
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.
Title MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mongodb Mongodb Server
cve-icon MITRE

Status: PUBLISHED

Assigner: mongodb

Published:

Updated: 2026-10-13T16:20:06.406Z

Reserved: 2026-09-22T21:59:02.204Z

Link: CVE-2026-96297

cve-icon Vulnrichment

Updated: 2026-10-13T16:15:36.370Z

cve-icon NVD

Status : Received

Published: 2026-10-13T16:17:24.180

Modified: 2026-10-13T17:17:49.290

Link: CVE-2026-96297

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:15:14Z

Weaknesses