MongoDB Alerts

This page lists critical alerts and advisories for MongoDB. See the MongoDB JIRA for a comprehensive list of bugs and feature requests.

Data integrity related

Operations Related

Security Related

Data Integrity Related

11/12/2021

A storage engine bug in MongoDB 4.4.2-4.4.4 can introduce corruption when upgrading to 4.4.8+ or 5.0.2+

Affects:

MongoDB Server

versions:

4.4.2
4.4.3
4.4.4

Reference Link →
09/22/2021

A storage engine bug in MongoDB 4.4.2-4.4.8, and 5.0.0-5.0.2 can cause inconsistent data after an unclean shutdown and restart. Upgrade to version 4.4.9 or 5.0.3.

Affects:

MongoDB Server

versions:

4.4.2-4.4.8
5.0.0-5.0.2

Reference Link →
09/22/2021

A storage engine bug in MongoDB 4.4.8 can cause inconsistent data after an unclean shutdown and restart. Upgrade to version 4.4.9.

Affects:

MongoDB Server

versions:

4.4.8

Reference Link →
08/06/2021

A storage engine bug in MongoDB 4.4.7, 5.0.0, and 5.0.1 allows some inserts to violate unique index constraints. Upgrade to version 4.4.8 or 5.0.2.

Affects:

MongoDB Server

versions:

4.4.7
5.0.0
5.0.1

Reference Link →
05/19/2021

A storage engine bug in MongoDB 4.4.5 causes crashes on startup and may cause temporary query correctness issues. Upgrade to version 4.4.6.

Affects:

MongoDB Server

versions:

4.4.5

Reference Link →
10/12/2020

Possible Corruption of Backup Snapshots on certain MongoDB 4.2+ Products

Affects:

MongoDB Server

versions:

4.2+

Reference Link →
06/16/2020

Possible buffer overflow may result cause in-memory corruption on MongoDB 4.2.7 with incremental backup enabled.

Affects:

MongoDB Server

versions:

4.2.7

Reference Link →
01/09/2020

A memory management bug can cause lost documents and index inconsistencies on replica set secondaries that restart during index builds.

Affects:

MongoDB Server

versions:

4.2.0
4.2.1

Reference Link →
01/07/2020

When MongoDB recovers from an unclean shutdown, it is possible for the recovery process to corrupt documents that have received size-changing updates.

Affects:

MongoDB Server

versions:

3.6.14
3.6.15

Reference Link →
09/23/2019

A memory management bug can cause failed operations, process crashes, and in-memory corruption of data that may be persisted to disk.

Affects:

MongoDB Server

versions:

4.2.0

Reference Link →
02/22/2018

We have identified a bug in MongoDB Compass where modification or deletion of a document through Compass may occur on a different document than expected under certain specific conditions.

Affects:

Compass

versions:

1.3.x - 1.11.1

Reference Link →
05/03/2016

While a background index build is in progress, document updates modifying fields contained in the index specification may, under specific circumstances, cause mismatched index entries to appear. This has an impact on queries that use affected indexes.

Affects:

Indexing

versions:

3.0
3.2

Reference Link →
03/30/2016

During chunk migrations, insert and update operations affecting data within a migrating chunk are not reflected to the recipient shard, resulting in data loss.

Affects:

Sharding

versions:

3.0.9
3.0.10

Reference Link →
12/16/2015

In a replica set, if a secondary node is shut down cleanly while replicating writes, the node may mark certain replicated operations as successfully applied even though they have not.

Affects:

Replication

versions:

3.2.0

Reference Link →
12/09/2015

A race condition in WiredTiger may prevent a write operation from becoming immediately visible to subsequent read operations, which may result in various problems, primarily impacting replication.

Affects:

WiredTiger

versions:

3.0.0 - 3.0.7

Reference Link →
06/15/2015

Sharded clusters where the balancer is enabled (or there are manual chunk migrations), containing WiredTiger nodes that may become primary, may lose writes to a chunk being migrated if that chunk is under a heavy write load.

Affects:

Sharding

versions:

3.0.0 - 3.0.3

Reference Link →
10/02/2014

MongoDB installations on certain 3.x Linux kernels running on VMWare and using virtual SCSI disks managed by LVM may see corruption in namespace (.ns) files.

Affects:

Storage

versions:

2.4.11
2.6.4

Reference Link →
08/03/2014

An update to a text-indexed field may fail to update the text index. As a result, a text search may not match the field contents, yielding incorrect search results.

Affects:

Text Search

versions:

2.4.0 - 2.4.10
2.6.0

Reference Link →
01/01/2014

Under very rare circumstances mongos may incorrectly report a write as successful.

Affects:

Sharding

versions:

2.2.0 - 2.2.6
2.4.0 - 2.4.8

Reference Link →
10/21/2013

During a chunk migration in a sharded cluster, if one of the documents in the chunk has a size in the range of 16,776,185 and 16,777,216 bytes (inclusive), then some documents may be lost during the migration process

Affects:

Sharding

versions:

2.2.0 - 2.2.5
2.4.0 - 2.4.4

Reference Link →
03/21/2013

Secondary indexes (i.e. all indexes other than _id) may be corrupted on an initial sync if write operations are performed on the sync source during the initial sync.

Affects:

Replication

versions:

2.4.0

Reference Link →

Operations Related

10/29/2013

Caching of dbhash results may result in stale values, potentially causing disagreement among sharded cluster config servers.

Affects:

MongoDB Server

versions:

2.4.7

Reference Link →

Security Related

11/24/2021
CVE-2021-32037
6.5

User may trigger invariant when allowed to send commands directly to shards

An authorized user may trigger an invariant which may result in denial of service or serve...

Affects:

MongoDB Server

versions:

5.0.0
5.0.1
5.0.2

Reference Link →
08/02/2021
CVE-2021-20332
4.2

MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application

Specific MongoDB Rust Driver versions can include credentials used by the connection pool ...

Affects:

MongoDB Rust Driver

versions:

1.0.0 affects 1.2.1 and prior versions
2.0.0-alpha
2.0.0-alpha1

Reference Link →
07/23/2021
CVE-2021-20333
5.3

Server log entry spoofing via newline injection

Sending specially crafted commands to a MongoDB Server may result in artificial log entrie...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.20
4.0 affects versions prior to 4.0.21
4.2 affects versions prior to 4.2.10

Reference Link →
06/10/2021
CVE-2021-20329
6.8

Specific cstrings input may not be properly validated in the Go Driver

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marsha...

Affects:

MongoDB Go Driver

versions:

1.0 affects 1.5.0 and prior versions

Reference Link →
05/24/2021
CVE-2021-20331
4.2

MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application

Specific versions of the MongoDB C# Driver may erroneously publish events containing authe...

Affects:

MongoDB C# Driver

versions:

2.12 affects 2.12.1 and prior versions

Reference Link →
04/30/2021
CVE-2021-20326
6.5

Specially crafted query may result in a denial of service of mongod

A user authorized to performing a specific type of find query may trigger a denial of serv...

Affects:

MongoDB Server

versions:

4.4 affects versions prior to 4.4.4

Reference Link →
04/12/2021
CVE-2020-7924
4.2

Specific command line parameter might result in accepting invalid certificate

Usage of specific command line parameter in MongoDB Tools which was originally intended to...

Affects:

MongoDB Database Tools

versions:

3.6 affects versions later than 3.6.5
3.6 affects versions prior to 3.6.21
4.0 affects versions prior to 4.0.21
4.2 affects versions prior to 4.2.11
100 affects versions prior to 100.2.0

Reference Link →
04/06/2021
CVE-2021-20334
4.8

Local privilege escalation in MongoDB Compass for Windows

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is in...

Affects:

MongoDB Compass

versions:

1.x affects 1.3.0 and later versions
1.x affects versions prior to 1.25.0

Reference Link →
02/26/2021
CVE-2020-7929
6.5

Specially crafted regex query can cause DoS

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.21
4.0 affects versions prior to 4.0.20

Reference Link →
02/26/2021
CVE-2018-25004
4.8

Invariant failure when explaining a find with a UUID

A user authorized to performing a specific type of query may trigger a denial of service b...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.11
4.0 affects versions prior to 4.0.6

Reference Link →
02/25/2021
CVE-2021-20328
6.4

MongoDB Java driver client-side field level encryption not verifying KMS host name

Specific versions of the Java driver that support client-side field level encryption (CSFL...

Affects:

mongo-java-driver

versions:

3.11 affects 3.11.2 and prior versions
3.12 affects 3.12.7 and prior versions

Reference Link →
02/25/2021
CVE-2021-20327
6.4

MongoDB Node.js client side field level encryption library may not be validating KMS certificate

A specific version of the Node.js mongodb-client-encryption module does not perform correc...

Affects:

mongodb-client-encryption module

versions:

1.2.0

Reference Link →
02/11/2021
CVE-2021-20335
6.7

SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager

For MongoDB Ops Manager <= 4.2.24 with multiple OM application servers, that have SSL turn...

Affects:

Ops Manager

versions:

4.2 affects 4.2.24 and prior versions

Reference Link →
12/01/2020
CVE-2019-20924
6.5

Invariant in IndexBoundsBuilder

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

4.2 affects versions prior to 4.2.2

Reference Link →
11/30/2020
CVE-2020-7925
7.5

Denial of Service when processing malformed Role names

Incorrect validation of user input in the role name parser may lead to use of uninitialize...

Affects:

MongoDB Server

versions:

4.2 affects versions prior to 4.2.9
4.4 affects versions prior to 4.4.0-rc12

Reference Link →
11/30/2020
CVE-2020-7926
6.5

Specific query can cause a DoS against MongoDB Server

A user authorized to perform database queries may cause denial of service by issuing a spe...

Affects:

MongoDB Server

versions:

4.4 affects versions prior to 4.4.1

Reference Link →
11/30/2020
CVE-2020-7927
8.1

Potential privilege escalation in Ops Manager API

Specially crafted API calls may allow an authenticated user who holds Organization Owner p...

Affects:

MongoDB Ops Manager

versions:

4.2 affects 4.2.17 and prior versions
4.3 affects 4.3.9 and prior versions
4.4 affects 4.4.2 and prior versions

Reference Link →
11/30/2020
CVE-2019-2392
6.5

$mod can result in UB

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.20
4.0 affects versions prior to 4.0.20
4.2 affects versions prior to 4.2.9
4.4 affects versions prior to 4.4.1

Reference Link →
11/30/2020
CVE-2019-2393
6.5

Crash while joining collections with $lookup

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.15
4.0 affects versions prior to 4.0.13
4.2 affects versions prior to 4.2.1

Reference Link →
11/30/2020
CVE-2019-20923
6.5

Crash while handling internal Javascript exception types

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

4.0 affects versions prior to 4.0.7

Reference Link →
11/30/2020
CVE-2018-20802
6.5

Post-auth queries on compound index may crash mongod

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.9
4.0 affects versions prior to 4.0.3

Reference Link →
11/30/2020
CVE-2018-20804
6.5

Invariant failure in applyOps

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.13
4.0 affects versions prior to 4.0.10

Reference Link →
11/30/2020
CVE-2018-20805
6.5

Invariant with $elemMatch

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

3.6 affects versions prior to 3.6.10
4.0 affects versions prior to 4.0.5

Reference Link →
11/24/2020
CVE-2019-20925
7.5

Denial of service via malformed network packet

An unauthenticated client can trigger denial of service by issuing specially crafted wire ...

Affects:

MongoDB Server

versions:

4.2 affects versions prior to 4.2.1
4.0 affects versions prior to 4.0.13
3.6 affects versions prior to 3.6.15
3.4 affects versions prior to 3.4.24

Reference Link →
11/23/2020
CVE-2020-7928
6.5

Improper neutralization of null byte leads to read overrun

A user authorized to perform database queries may trigger a read overrun and access arbitr...

Affects:

MongoDB Server

versions:

4.4 affects versions prior to 4.4.1
4.2 affects versions prior to 4.2.9
4.0 affects versions prior to 4.0.20
3.6 affects versions prior to 3.6.20

Reference Link →
11/23/2020
CVE-2018-20803
6.5

Infinite loop in aggregation expression

A user authorized to perform database queries may trigger denial of service by issuing spe...

Affects:

MongoDB Server

versions:

4.0 affects versions prior to 4.0.5
3.6 affects versions prior to 3.6.10
3.4 affects versions prior to 3.4.19

Reference Link →
08/21/2020
CVE-2020-7923
6.5

Specific GeoQuery can cause DoS against MongoDB Server

A user authorized to perform database queries may cause denial of service by issuing speci...

Affects:

MongoDB Server

versions:

4.4 affects versions prior to 4.4.0-rc7
4.2 affects versions prior to 4.2.8
4.0 affects versions prior to 4.0.19

Reference Link →
05/13/2020
CVE-2019-2388
5.8

Potential exposure of log information in Ops Manager

In affected Ops Manager versions there is an exposed http route was that may allow attacke...

Affects:

Ops Manager

versions:

4.0.9
4.0.10
4.1.5

Reference Link →
05/06/2020
CVE-2020-7921
4.6

Administrative action may disable enforcement of per-user IP whitelisting

Improper serialization of internal state in the authorization subsystem in MongoDB Server'...

Affects:

MongoDB Server

versions:

4.2 affects versions prior to 4.2.3
4.0 affects versions prior to 4.0.15
3.6 affects versions prior to 3.6.18
4.3 affects versions prior to 4.3.3

Reference Link →
04/09/2020
CVE-2020-7922
6.4

Kubernetes Operator generates potentially insecure certificates

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an at...

Affects:

MongoDB Enterprise Kubernetes Operator

versions:

1.0
1.1
1.2 affects 1.2.4 and prior versions
1.3 affects 1.3.1 and prior versions
1.4 affects 1.4.4 and prior versions

Reference Link →
03/31/2020
CVE-2019-2391
4.2

JS-bson may incorrectly serialise some requests

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BS...

Affects:

js-bson

versions:

1.0 affects 1.1.3 and prior versions

Reference Link →
08/30/2019
CVE-2019-2390
8.2

Code execution on Windows via OpenSSL engine injection

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuratio...

Affects:

MongoDB Server

versions:

4.0 affects versions prior to 4.0.11
3.6 affects versions prior to 3.6.14
3.4 affects versions prior to 3.4.22

Reference Link →
08/30/2019
CVE-2019-2389
5.3

Process termination via PID file manipulation

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow ...

Affects:

MongoDB Server

versions:

4.0 affects versions prior to 4.0.11
3.6 affects versions prior to 3.6.14
3.4 affects versions prior to 3.4.22

Reference Link →
08/06/2019
CVE-2019-2386
7.1

Authorization session conflation

After user deletion in MongoDB Server the improper invalidation of authorization sessions ...

Affects:

MongoDB Server

versions:

4.0 affects versions prior to 4.0.9
3.6 affects versions prior to 3.6.13
3.4 affects versions prior to 3.4.22

Reference Link →