The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:XMongodb
APPMongodb7.0.0 – 7.0.39 (excl.)8.0.0 – 8.0.28 (excl.)8.2.0 – 8.2.12 (excl.)8.3.0 – 8.3.7 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References
Related vulnerabilities
CVE-2026-13072CRITICAL9.2PL ✓same product
Heap Buffer Overflow w MongoDB (tryb compute) podczas przetwarzania BSON
CVE-2017-15535CRITICAL9.1PL ✓same product
MongoDB: podatność w kompresji protokołu sieciowego — DoS i modyfikacja pamięci
CVE-2025-14847HIGH8.7⚠ KEVsame product
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by ...
CVE-2026-13056HIGH7.1PL ✓same product
MongoDB – wyczerpanie pamięci przez wyrażenia generujące duże tablice (DoS)
CVE-2026-13058HIGH7.1PL ✓same product
MongoDB: DoS przez nieprawidłowe polecenie transakcji — CWE-617