CVE-2026-9752: MongoDB 2dsphere Null-Pointer DoS via GeoJSON GeometryCollection

Technical summary

CVE-2026-9752 is a null-pointer dereference vulnerability in MongoDB's geospatial indexing subsystem. The 2dsphere index implementation intentionally rejects strict-winding Polygon geometries at parse time due to mathematical incompatibility with spherical geometry calculations. However, the validation guard only examines top-level GeoJSON objects and does not recursively inspect members of a GeometryCollection wrapper. An authenticated attacker can embed a strict-winding Polygon inside a GeometryCollection, evading the protective check. When the index processes this nested polygon, it reaches an unsafe code path that dereferences a null pointer, crashing the mongod process. The vulnerability requires valid database credentials and the ability to execute queries, but no special privileges or administrative access.

Business impact

This vulnerability enables a denial-of-service attack against MongoDB deployments. Any authenticated database user—including application service accounts with minimal privileges—can force unplanned service restarts. In production environments, repeated crashes disrupt application availability, trigger incident response overhead, and may cause cascading failures in dependent services. Organizations relying on MongoDB for critical workloads face potential SLA violations and customer-facing downtime. The threat is amplified in shared or multi-tenant database instances where multiple applications or teams share the same MongoDB cluster.

Affected systems

MongoDB instances across all versions that support 2dsphere geospatial indexing are potentially affected. The vendor and product identifier is mongodb:mongodb. Verify the specific affected version range and any version that includes a fix against the official MongoDB security advisory, as this summary does not specify version boundaries.

Exploitability

Exploitability is straightforward for any user with database access. No network-level bypasses, race conditions, or complex setup is required. An attacker needs only valid credentials and the ability to submit a query—a capability present in most application integration scenarios. The attack is repeatable and deterministic. However, the requirement for prior authentication prevents unauthenticated remote exploitation. Organizations with strong access controls and application-level query validation will see reduced risk.

Remediation

Apply the MongoDB security patch released for this vulnerability. Verify the patched version number against the official MongoDB security advisory. Additionally, implement database-level access controls to restrict query execution to trusted application accounts, and consider deploying network segmentation to limit which services can reach MongoDB instances. Disable 2dsphere indexing on non-geospatial workloads if not required.

Patch guidance

Consult the official MongoDB security advisory to identify the patched version for your release series (e.g., 4.4.x, 5.0.x, 6.0.x, etc.). MongoDB typically issues patches across multiple supported versions. Apply the patch during a scheduled maintenance window to minimize service disruption. For high-availability deployments with replica sets, perform a rolling restart to avoid cluster downtime. Test the patch in a staging environment against your application queries before production deployment. Verify that geospatial queries continue to function correctly post-patch.

Detection guidance

Monitor MongoDB logs for repeated connection attempts from internal applications followed by immediate disconnections, which may indicate crash-and-reconnect patterns. Enable MongoDB's query profiler to capture slow or unusual queries targeting 2dsphere indexes. Look for application errors reporting unexpected MongoDB connection losses. In security monitoring, detect queries that construct GeoJSON GeometryCollection objects with Polygon members, particularly if followed by service restarts. Network-based detection is difficult; focus on endpoint and database-level telemetry.

Why prioritize this

MEDIUM severity (CVSS 6.5) reflects the authentication requirement that prevents remote unauthenticated attacks. However, prioritize patching because availability impact is high and exploitability is trivial for any insider or compromised application account. Organizations with strict database access controls and mature query validation practices face lower immediate risk but should still patch within a standard maintenance cycle. The fix is non-invasive and poses minimal regression risk.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) is derived from a network-accessible service (AV:N) with low complexity (AC:L) requiring low-level privilege (PR:L, authenticated user). The impact is availability-only (A:H for denial of service via crash), with no confidentiality or integrity compromise (C:N, I:N). The scoped impact (S:U) indicates the crash affects only the targeted service. This rating appropriately reflects a denial-of-service condition that does not lead to data breach or privilege escalation.

Frequently asked questions