CVE-2026-9748: $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

Synopsis

A denial-of-service vulnerability affects MongoDB Server in the aggregation pipeline stage $_internalConvertBucketIndexStats. An authenticated attacker with a low-privilege account can reach the affected code over the network by submitting a crafted aggregation pipeline that places $_internalConvertBucketIndexStats before a $facet stage on non-timeseries input, causing TeeBuffer to hit a hard invariant assertion and crash the mongod process. Successful exploitation brings down the database server, causing a full service outage for all connected clients. Patched-image rebuilds at versions 7.0.35, 8.0.10, 8.2.10, and 8.3.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MongoDB query interface over the network to submit the malicious aggregation pipeline.

• AuthenticationRequired

  A valid database account is needed, though any low-privilege account with permission to run aggregation queries is sufficient.

• Victim interactionNot required

  No user or administrator action is required beyond the attacker issuing the crafted query.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the crash is deterministically triggered by placing $_internalConvertBucketIndexStats before $facet on non-timeseries input, with no race conditions or environmental dependencies.

Blast Radius

• The mongod process terminates immediately on hitting the invariant assertion, taking the entire database server offline.
• All client connections to the affected mongod instance are dropped, interrupting reads and writes for every application sharing that server.
• In replica set or sharded deployments, the crashed primary triggers an election or failover, introducing latency and a window of reduced availability during re-election.
• No confidential data is read and no stored data is modified; the impact is limited to availability.