CVE-2026-9740: Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9740?
The severity of CVE-2026-9740 is classified as high with a score of 7.5.
What does CVE-2026-9740 affect?
CVE-2026-9740 affects MongoDB Server by exploiting the BSON validation logic.
How do I fix CVE-2026-9740?
To fix CVE-2026-9740, update your MongoDB Server to the latest version that addresses this vulnerability.
What type of attack does CVE-2026-9740 allow?
CVE-2026-9740 allows an unauthenticated user to crash the mongod process by sending a specially crafted message.
What is the primary impact of CVE-2026-9740?
The primary impact of CVE-2026-9740 is a pre-authentication stack overflow due to unbounded recursion in BSON validation.