[CVE-2026-9753] The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff con…

Descripción técnica

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

Puntuación CVSS

Score: 8.1/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Productos afectados

Mongodb — Mongodb

Debilidades (CWE)

CWE-1287, CWE-787

Fuente oficial

Publicado en NIST NVD.