CVE-2026-9737: 
MongoDB 脆弱性の分析と軽減

CVE-2026-9737 is a Denial of Service vulnerability in MongoDB Server caused by a reachable assertion (CWE-617) during query planning. When reading sort patterns in raw BSONObj form, the meta expression case is not explicitly handled in some code paths, leading to incorrect transformations and invariant failures that can crash the database service. Affected versions include MongoDB Server 7.0 before 7.0.39, 8.0 before 8.0.28, 8.2.0 before 8.2.12, and 8.3.0 before 8.3.7. The vulnerability was published on July 22, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-617 (Reachable Assertion): during query planning, MongoDB reads sort patterns in raw BSONObj form but fails to handle the meta expression case in certain code paths, resulting in incorrect transformations that trigger an invariant failure. An authenticated attacker with low privileges can exploit this remotely by crafting a query containing a malformed sort pattern that exercises the unhandled meta expression branch. No special conditions beyond valid database credentials are required, and no user interaction is needed. The upstream issue is tracked at MongoDB's Jira as SERVER-128341 (GitHub Advisory, MongoDB Jira).

Successful exploitation causes the MongoDB server process to crash due to an invariant failure, resulting in a complete loss of database availability for all connected clients and applications. There is no impact on confidentiality or data integrity — the vulnerability is purely a Denial of Service. Repeated exploitation could be used to keep a targeted MongoDB instance persistently unavailable, disrupting dependent services (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.41% (0.235% per GitHub Advisory), placing it in the 14th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. SSVC assessment indicates exploitation is currently "none" and the vulnerability is not automatable (GitHub Advisory).

1. Authenticate to MongoDB: Obtain valid low-privilege database credentials (e.g., a read or readWrite role on any database).
2. Identify a vulnerable version: Confirm the target MongoDB Server is running a version in the affected ranges (7.0 < 7.0.39, 8.0 < 8.0.28, 8.2.0 < 8.2.12, or 8.3.0 < 8.3.7).
3. Craft a malicious query: Construct a query that includes a sort pattern using a meta expression (e.g., { $meta: "textScore" }) in a context that triggers the unhandled code path during query planning.
4. Submit the query: Execute the crafted query against the target MongoDB instance using any MongoDB client or driver.
5. Trigger invariant failure: The query planner processes the malformed sort pattern, encounters the unhandled meta expression case, performs an incorrect transformation, and triggers an invariant assertion failure, causing the mongod process to crash and the database to become unavailable (GitHub Advisory, MongoDB Jira).

• Logs: MongoDB server logs (mongod.log) showing invariant failure messages or assertion errors during query planning, particularly referencing sort pattern or BSONObj processing; abrupt process termination entries.
• Process: Unexpected mongod process crash or restart; monitoring systems alerting on MongoDB service unavailability.
• Network: Repeated authenticated connections from the same client IP followed by immediate server crashes; unusual query patterns involving sort with meta expressions against collections not configured for text search.

MongoDB has released patched versions addressing this vulnerability: 7.0.39, 8.0.28, 8.2.12, and 8.3.7. Administrators should upgrade to the appropriate fixed version as the primary remediation. As interim mitigations, restrict database access to trusted and necessary users only, and monitor for unexpected mongod crashes related to query planning failures. The patch is referenced in GitHub Advisory GHSA-528v-8qvj-8g29 (GitHub Advisory, MongoDB Jira).

A Reddit post in r/pwnhub briefly discussed the vulnerability shortly after disclosure. Tenable published a Nessus plugin (ID 329413) to detect affected MongoDB versions. Beyond Machines noted this CVE as part of a broader MongoDB security release patching 26 vulnerabilities. No significant vendor statements or notable researcher commentary beyond standard tracking have been observed (GitHub Advisory).