CVE-2026-9743: Aggregation sub-pipeline null dereference may allow DoS via crafted getMore

Synopsis

A null pointer dereference in MongoDB Server 8.0 allows an authenticated user to crash the database process. The vulnerability is reachable over the network and requires only a low-privilege account; no special configuration is needed. An attacker crafts an aggregation pipeline that leaves an internal sub-pipeline field null, then issues a getMore on the resulting cursor, causing the server to dereference an invalid address and terminate. A patched-image rebuild at version 8.0.24 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MongoDB server over the network to issue aggregation and getMore commands.

• AuthenticationRequired

  Any low-privilege account that has permission to run aggregation pipelines is sufficient to trigger the crash.

• Victim interactionNot required

  No action from another user or operator is needed; the attacker issues the crafted sequence entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or environmental factors need to align.

Blast Radius

• The MongoDB server process crashes, making the database unavailable to all connected applications until the process is restarted.
• Any in-flight transactions or writes that had not yet been committed are lost at the moment of the crash.
• Repeated exploitation keeps the service in a crash-restart loop, effectively taking the database offline for the duration of the attack.