CVE-2026-9752: 
MongoDB vulnerability analysis and mitigation

CVE-2026-9752 is a NULL pointer dereference vulnerability in MongoDB Server that allows an authenticated user to crash the database server by submitting a specially crafted geospatial query. The flaw affects MongoDB Server versions 7.0.0–7.0.34, 8.0.0–8.0.23, 8.2.0–8.2.9, and 8.3.0–8.3.2. It was published on June 9, 2026, with a patch advisory released on June 10, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, MongoDB Jira).

The root cause is a NULL pointer dereference (CWE-476) in MongoDB's 2dsphere index processing logic. Strict-winding polygons in GeoJSON are intentionally unsupported for indexing, and a guard exists to reject them; however, this guard fails to inspect members nested within a GeoJSON GeometryCollection. When a query targets a field containing a GeometryCollection that includes a Polygon with a strict-winding Coordinate Reference System (CRS), the validation bypass allows execution to reach an unsafe code path, resulting in a null-pointer dereference and server crash. Exploitation requires only low-privilege authenticated access and no user interaction, making it straightforward for any authorized database user to trigger (GitHub Advisory, MongoDB Jira).

Successful exploitation results in a complete denial of service — the MongoDB server process crashes, making the database unavailable to all users and applications. There is no impact on confidentiality or data integrity; the vulnerability is purely an availability issue. In environments where MongoDB serves as a critical backend, repeated exploitation could cause sustained outages and disrupt dependent services (GitHub Advisory).

1. Obtain authenticated access: Acquire valid credentials for a MongoDB instance running an affected version (7.0.0–7.0.34, 8.0.0–8.0.23, 8.2.0–8.2.9, or 8.3.0–8.3.2) with at least read permissions on a collection.
2. Prepare malicious GeoJSON document: Construct a document containing a GeoJSON GeometryCollection that includes a Polygon with a strict-winding (clockwise exterior ring) Coordinate Reference System, e.g.:

{
  "location": {
    "type": "GeometryCollection",
    "geometries": [{
      "type": "Polygon",
      "coordinates": [[[0,0],[0,1],[1,1],[1,0],[0,0]]],
      "crs": { "type": "name", "properties": { "name": "urn:x-mongodb:crs:strictwinding:EPSG:4326" } }
    }]
  }
}

3. Insert the document: Insert the crafted document into a collection that has a 2dsphere index defined on the location field.
4. Trigger the crash: Execute a geospatial query against the indexed field (e.g., a $geoWithin or $near query). The 2dsphere index processing code will encounter the strict-winding polygon nested inside the GeometryCollection, bypass the validation guard, and dereference a null pointer, crashing the mongod process (GitHub Advisory, MongoDB Jira).

• Logs: Unexpected mongod process termination entries in system logs (e.g., systemd or syslog) coinciding with geospatial query execution; MongoDB logs showing fatal signal or segmentation fault immediately following a 2dsphere index query.
• Process: Sudden crash/restart of the mongod process without prior resource exhaustion warnings; core dump files generated in the MongoDB working directory.
• Network: Repeated connection drops from application servers to MongoDB port (default 27017) correlating with specific query patterns involving GeoJSON GeometryCollection types.
• Database: Audit logs (if enabled) showing queries with $geoWithin, $near, or similar spatial operators on collections with 2dsphere indexes, particularly from users not typically performing geospatial queries.

MongoDB has released patched versions addressing this vulnerability: 7.0.35, 8.0.24, 8.2.10, and 8.3.3. Users should upgrade to the appropriate fixed version for their release branch as the primary remediation (MongoDB Jira, GitHub Advisory). As a workaround where immediate patching is not possible, restrict database query permissions to only trusted, vetted users and monitor for unusual geospatial queries. Removing or avoiding 2dsphere indexes on fields that may store GeometryCollection data can also reduce exposure until patching is feasible.

Percona published a security advisory noting the vulnerability's impact on Percona Server for MongoDB, recommending users apply the upstream MongoDB patches (Percona Blog). Red Hat also tracked the vulnerability for its MongoDB-related packages (Red Hat). Tenable released a Nessus detection plugin (ID 320804) for the vulnerability. Overall community reaction has been measured, consistent with the limited exploitation risk and availability-only impact.