CVE-2026-9740: MongoDB BSON Validation Denial of Service (Unauthenticated)

Technical summary

CVE-2026-9740 stems from insufficient recursion depth tracking in MongoDB Server's BSON validation logic. The vulnerability exists in how the validator processes nested binary data structures. When processing certain payloads, validation functions can re-enter in an uncontrolled manner, with each recursion level resetting the internal depth counter rather than accumulating it. This allows an attacker to bypass recursion limits and trigger a stack overflow or resource exhaustion condition that terminates the mongod process. The issue is reachable over the network without authentication, making it exploitable by any network-adjacent actor.

Business impact

An attacker can render MongoDB instances unavailable on-demand, disrupting all dependent applications and services. Organizations relying on MongoDB for production workloads face potential service outages, data access disruption, and operational cascades if failover mechanisms are not properly configured. Recovery requires manual mongod restart, consuming incident response resources. In multi-tenant or cloud environments, a single unauthenticated network request can impact multiple customers or services sharing a MongoDB instance.

Affected systems

MongoDB Server instances are affected. The vulnerability is network-exploitable and requires no authentication, meaning any MongoDB deployment exposed to untrusted networks (or reachable from them) is at risk. This includes cloud-hosted MongoDB, on-premises deployments accessible from the internet, and internal instances if the attacker has network connectivity to the MongoDB port.

Exploitability

Exploitability is straightforward: the attack requires only network access to the MongoDB port and no valid credentials. An attacker can craft and send a malicious BSON message using standard MongoDB client libraries or raw network tools. The low complexity and absence of user interaction make this vulnerability highly exploitable. However, exploitation is not yet observed in the wild (KEV status is false), though the technical barrier to weaponization is minimal.

Remediation

Apply the security patch provided by MongoDB for CVE-2026-9740 as soon as practicable. Verify the patched version number in the MongoDB security advisory. Until patching is complete, mitigate by restricting network access to MongoDB ports using firewalls, network segmentation, or IP allowlisting. Disable MongoDB's network listener if the instance is not required to accept remote connections. Monitor mongod process availability and restart logs for unexpected terminations.

Patch guidance

Consult the MongoDB security advisory for the specific patched version addressing CVE-2026-9740. Test the patch in a non-production environment before deployment. Given the denial-of-service nature and high CVSS score (7.5), plan patching within your standard critical-priority timelines. Verify that the patch is applied to all MongoDB Server instances in your environment, including replicas and shards. Confirm mongod process stability after patching by monitoring for any restart anomalies over a 24–48 hour period.

Detection guidance

Monitor for unexpected mongod process crashes or restarts, especially those not preceded by maintenance windows or configuration changes. Review MongoDB logs for BSON validation errors or stack trace messages. Implement network-level detection by monitoring for malformed BSON messages or unusual binary payloads sent to MongoDB ports. Alert on repeated connection attempts followed by process termination. Establish a baseline of normal mongod uptime and flag deviations. If you suspect exploitation, correlate process termination timing with incoming network traffic to the MongoDB port.

Why prioritize this

Despite KEV status being false (not yet exploited in the wild), this vulnerability merits immediate attention due to high severity, trivial exploitability, and complete lack of authentication barriers. Any attacker with network access can trigger a denial-of-service condition. Organizations should prioritize patching according to criticality of MongoDB availability in their infrastructure, but high-availability deployments should still treat this as urgent to prevent cascading service disruptions.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable, unauthenticated attack that results in availability loss (denial of service) with no impact on confidentiality or integrity. The score does not account for ease of weaponization or lack of current real-world exploitation, but the vector (AV:N/AC:L/PR:N) underscores the low barrier to attack. Organizations should factor in their MongoDB's exposure to untrusted networks and the business criticality of database availability when determining actual risk within their environment.

Frequently asked questions