VulnSocial

CVE-2026-9740Patch(mongodb / mongodb)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch mongodb mongodb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

mongodb CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-674

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mongodb

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-06-11); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
mongodb
Products
mongodb

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-11: 1Mentions · 2026-06-17: 1Mentions · 2026-06-30: 1Patch / Workaround · 2026-06-11: 1Patch / Workaround · 2026-06-30: 1Technical Details · 2026-06-11: 1Technical Details · 2026-06-30: 106-1106-1706-30
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-111
Patch1
2026-06-171
General1
2026-06-301
Patch1
Full discourse3 posts
  • The NoSQL Nerd@NoSQLNerd
    Patch

    MongoDB Server just patched CVE-2026-11933, an 8.7 CVSS use-after-free in the JS engine. Authenticated users can crash mongod or leak memory via $where. Also CVE-2026-9740, an unauth BSON recursion DoS. https://securityonline.info/mongodb-server-vulnerability

    Post summary

    The post announces that MongoDB Server has patched CVE‑2026‑11933 (an 8.7‑rated use‑after‑free that can crash or leak memory via $where) and CVE‑2026‑9740 (an unauthenticated BSON recursion DoS).

    0000044
    16 followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos MongoDB ❗ CVE-2026-9753 ❗ CVE-2026-9742 ❗ CVE-2026-9740 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mongodb-3/ https://t.co/LQbWTtCKWM

    Post summary

    The post lists three MongoDB CVEs and provides links for further information, but contains no technical, exploit, or patch details.

    00000102
    6.7K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-9740 (CVSS 7.5) MongoDB Server BSON validation flaw allows unauthenticated attackers to crash mongod remotely. CWE-674: Uncontrolled recursion in nested binary data handling. Patch immediately. #CVE #PatchNow https://t.co/AqcNuHTK41

    Post summary

    The tweet announces a high‑severity MongoDB Server flaw (CVE‑2026‑9740) that allows unauthenticated remote crashes via BSON validation, and urges users to patch immediately.

    0000044
    44 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmongodbmongodb---

Explore more

Back to dashboardmongodb CVEsmongodb vulnerabilities