CVE-2026-9746
- Source
- https://cve.org/CVERecord?id=CVE-2026-9746
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9746.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-9746
- Aliases
- Downstream
- Published
- 2026-06-09T22:02:12.772Z
- Modified
- 2026-07-08T08:12:42.008495534Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Server crashes in case of the use of exchange
- Details
-
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9746.json", "cna_assigner": "mongodb", "cwe_ids": [ "CWE-617" ], "unresolved_ranges": [ { "extracted_events": [ { "introduced": "8.3.0" }, { "fixed": "8.3.3" }, { "introduced": "8.2.0" }, { "fixed": "8.2.10" }, { "introduced": "8.0.0" }, { "fixed": "8.0.24" }, { "introduced": "7.0.0" }, { "fixed": "7.0.35" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/mongodb/mongo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mongodb/mongo
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "extracted_events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.35" }, { "introduced": "8.0.0" }, { "fixed": "8.0.24" }, { "introduced": "8.2.0" }, { "fixed": "8.2.10" }, { "introduced": "8.3.0" }, { "fixed": "8.3.3" } ], "source": "CPE_RANGE" }
Affected versions
r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.10
r7.0.10-rc0
r7.0.11
r7.0.11-rc0
r7.0.11-rc1
r7.0.11-rc2
r7.0.12
r7.0.12-rc0
r7.0.12-rc1
r7.0.13
r7.0.13-rc0
r7.0.13-rc1
r7.0.14
r7.0.14-rc0
r7.0.15
r7.0.15-rc0
r7.0.15-rc1
r7.0.16
r7.0.16-rc0
r7.0.16-rc1
r7.0.17
r7.0.18
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.21
r7.0.21-alpha0
r7.0.21-rc0
r7.0.22
r7.0.22-rc0
r7.0.23
r7.0.23-rc0
r7.0.23-rc1
r7.0.24
r7.0.24-rc0
r7.0.25-alpha0
r7.0.26
r7.0.26-rc0
r7.0.27
r7.0.27-alpha0
r7.0.27-rc0
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0
r7.0.6
r7.0.6-rc0
r7.0.7
r7.0.7-rc0
r7.0.7-rc1
r7.0.7-rc2
r7.0.8
r7.0.8-rc0
r7.0.9
r7.0.9-rc0
r7.0.9-rc1
r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.16
r8.0.16-rc0
r8.0.16-rc1
r8.0.17-alpha0
r8.0.2
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
r8.2.0
r8.2.1
r8.2.1-rc0
r8.2.1-rc1
r8.2.2
r8.2.2-rc0
r8.2.3-alpha0
r8.2.4-alpha0
r8.2.4-alpha1
r8.3.0