Product by Mongodb Inc.
Mongodb Server
82 known vulnerabilities in Mongodb Server (Mongodb Inc.), 1 of them actively exploited (CISA KEV).
Key figures
82
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-14847 | Zlib compressed protocol header length confusion may allow memory read In CISA KEValso in 1 other product | 7.5 | |
| High | CVE-2021-32040 | Large aggregation pipelines with a specific stage can crash mongod under default configuration | 6.5 | |
| High | CVE-2020-7925 | Denial of Service when processing malformed Role names | 7.5 | |
| High | CVE-2026-25611 | Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server | 7.5 | |
| High | CVE-2019-20925 | Denial of service via malformed network packet | 7.5 | |
| High | CVE-2026-8053 | FlatBSON Duplicate Field Index Drift | 8.8 | |
| Medium | CVE-2018-20802 | Post-auth queries on compound index may crash mongod | 6.5 | |
| High | CVE-2025-0755 | MongoDB C Driver bson library may be susceptible to buffer overflow | 8.4 | |
| Medium | CVE-2020-7928 | Improper neutralization of null byte leads to read overrun | 6.5 | |
| Medium | CVE-2018-20803 | Infinite loop in aggregation expression | 6.5 | |
| Medium | CVE-2020-7926 | Specific query can cause a DoS against MongoDB Server | 6.5 | |
| Medium | CVE-2020-7923 | Specific GeoQuery can cause DoS against MongoDB Server | 6.5 | |
| Medium | CVE-2020-7929 | Specially crafted regex query can cause DoS | 6.5 | |
| Medium | CVE-2019-20924 | Invariant in IndexBoundsBuilder | 6.5 | |
| Medium | CVE-2019-20923 | Crash while handling internal Javascript exception types | 6.5 | |
| Medium | CVE-2019-2392 | $mod can result in undefined behavior | 6.5 | |
| Medium | CVE-2019-2393 | Crash while joining collections with $lookup | 6.5 | |
| Medium | CVE-2018-20805 | Invariant with $elemMatch | 6.5 | |
| Medium | CVE-2018-20804 | Invariant failure in applyOps | 6.5 | |
| High | CVE-2019-2386 | Authorization session conflation | 7.1 | |
| Medium | CVE-2021-32037 | User may trigger invariant when allowed to send commands directly to shards | 6.5 | |
| High | CVE-2019-2390 | Code execution on Windows via OpenSSL engine injection | 8.2 | |
| Medium | CVE-2021-20330 | Specific replication command with malformed oplog entries can crash secondaries | 6.5 | |
| Medium | CVE-2021-20333 | Server log entry spoofing via newline injection | 5.3 | |
| Medium | CVE-2022-24272 | MongoDB Server (mongod) may crash in response to unexpected requests | 6.5 |
News
- CISA Adds One Known Exploited Vulnerability to Catalogcisa-advisories,