MongoDB Server vulnerabilities

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator mishandles nested binary data structures, leading to uncontrolled mutual recursion between validation functions.

Creating a '2dsphere_bucket' index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating 'queryable_encrypted_range' indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6.

MongoDB Server has a post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions, which may lead to logical data inconsistencies under specific conditions. This can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards, impacting integrity and availability.

An authorized user may crash the MongoDB server by causing a buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. The issue affects MongoDB Server v7.0 versions prior to 7.0.25, v8.0 versions prior to 8.0.15, and version 8.2.0.

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. Affects versions 6.0 before 6.0.25, 7.0 before 7.0.22, and 8.0 before 8.0.12.