MongoDB Server up to 7.0.34/8.0.23/8.2.9/8.3.2 Aggregation _internalApplyOplogUpdate improper validation of specified type of input

Summaryinfo

A vulnerability was found in MongoDB Server up to 7.0.34/8.0.23/8.2.9/8.3.2 and classified as critical. The impacted element is an unknown function of the component Aggregation Handler. The manipulation of the argument _internalApplyOplogUpdate results in improper validation of specified type of input. This vulnerability is known as CVE-2026-9753. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in MongoDB Server up to 7.0.34/8.0.23/8.2.9/8.3.2. Affected is an unknown code of the component Aggregation Handler. The manipulation of the argument _internalApplyOplogUpdate with an unknown input leads to a improper validation of specified type of input vulnerability. CWE is classifying the issue as CWE-1287. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

The weakness was published by Daffainfo. The advisory is shared for download at jira.mongodb.org. This vulnerability is traded as CVE-2026-9753 since 05/27/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 7.0.35, 8.0.24, 8.2.10 or 8.3.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• Server

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.0.13
• 7.0.14
• 7.0.15
• 7.0.16
• 7.0.17
• 7.0.18
• 7.0.19
• 7.0.20
• 7.0.21
• 7.0.22
• 7.0.23
• 7.0.24
• 7.0.25
• 7.0.26
• 7.0.27
• 7.0.28
• 7.0.29
• 7.0.30
• 7.0.31
• 7.0.32
• 7.0.33
• 7.0.34
• 8.0.0
• 8.0.1
• 8.0.2
• 8.0.3
• 8.0.4
• 8.0.5
• 8.0.6
• 8.0.7
• 8.0.8
• 8.0.9
• 8.0.10
• 8.0.11
• 8.0.12
• 8.0.13
• 8.0.14
• 8.0.15
• 8.0.16
• 8.0.17
• 8.0.18
• 8.0.19
• 8.0.20
• 8.0.21
• 8.0.22
• 8.0.23
• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3
• 8.2.4
• 8.2.5
• 8.2.6
• 8.2.7
• 8.2.8
• 8.2.9
• 8.3.0
• 8.3.1
• 8.3.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion