CVE-2026-9740: Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

Synopsis

A stack overflow vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated remote attacker to crash the mongod process by sending a specially crafted message. The flaw lies in unbounded mutual recursion between BSON validation functions, where each recursive re-entry resets the internal depth counter, allowing the call stack to grow without bound. Successful exploitation causes a complete denial of service by killing the database process. Patched-image rebuilds at versions 7.0.35, 8.0.24, 8.2.10, and 8.3.3 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the mongod service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials are required; the malformed BSON message can be sent before any authentication handshake completes.

• Victim interactionNot required

  No user action is needed; the attacker sends the crafted message directly to the server.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory-layout dependency, or special environmental state is required.

Blast Radius

• Crashes the mongod process, taking the database instance offline and making all hosted data unavailable for the duration of the outage.
• Any application or service depending on the affected MongoDB instance loses database connectivity immediately upon exploit.
• If the mongod process is not configured to auto-restart, the outage persists until an operator manually intervenes.
• No data is read or modified by this exploit; impact is limited to availability of the database service.