CVE-2026-9737: Find command with $meta sort can lead to crash
Published Jul 22, 2026
·Updated
During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.
Affected Software
1 affected component
MongoDB MongoDB
Event History
Jul 22, 2026
CVE Published
via MITRE·07:20 PM
Data Sourced
via MITRE·07:20 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Dec 29, 58528
Event
via NVD·05:04 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-9737?
CVE-2026-9737 has a medium severity rating of 6.5.
2
How do I fix CVE-2026-9737?
To mitigate CVE-2026-9737, ensure you are using the latest version of MongoDB that addresses this vulnerability.
3
What is the impact of CVE-2026-9737?
CVE-2026-9737 can potentially lead to a crash during query planning when handling sort patterns.
4
What software is affected by CVE-2026-9737?
CVE-2026-9737 affects MongoDB software.
5
How does CVE-2026-9737 occur?
CVE-2026-9737 occurs due to improper handling of the meta expression case in sort pattern transformations during query planning.