CVE-2026-9752— GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
Quick assessment
Affected
MongoDB MongoDB Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB Server是美国MongoDB公司的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server存在代码问题漏洞，该漏洞源于2dsphere索引在处理包含严格缠绕CRS多边形的GeoJSON GeometryCollection时未正确检查成员，可能导致空指针解引用并崩溃。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MongoDB | MongoDB Server | 8.3.0< 8.3.3 |
affected |
8.2.0< 8.2.10 |
affected | ||
8.0.0< 8.0.24 |
affected | ||
7.0.0< 7.0.35 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9752
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
Source: CVE Program / CVE List V5
Vulnerability Description
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS.
Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB Server 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB Server是美国MongoDB公司的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server存在代码问题漏洞，该漏洞源于2dsphere索引在处理包含严格缠绕CRS多边形的GeoJSON GeometryCollection时未正确检查成员，可能导致空指针解引用并崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 ~ 8.3.3 | - |
|
II. Public POCs for CVE-2026-9752
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9752
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-9752 (1)
Same Patch Batch · MongoDB · 2026-06-09 · 14 CVEs total
| CVE-2026-9753 | 8.1 HIGH | Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. |
| CVE-2026-9740 | 7.5 HIGH | Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow |
| CVE-2026-9742 | 7.5 HIGH | Authenticate command with specific mechanism parameter can trigger server crash |
| CVE-2026-9750 | 6.5 MEDIUM | Metadata name collision on $-prefixed fields causes post-auth server crash |
| CVE-2026-9748 | 6.5 MEDIUM | $_internalConvertBucketIndexStats may crash the mongod server when working on no timeserie |
| CVE-2026-9747 | 6.5 MEDIUM | Crafted cross-shard merge aggregation crashes MongoDB Server |
| CVE-2026-9741 | 6.5 MEDIUM | Client side encryption fails to encrypt values in a $vectorSearch |
| CVE-2026-9749 | 6.5 MEDIUM | Using MaxKey() may crash the server |
| CVE-2026-9746 | 6.5 MEDIUM | Server crashes in case of the use of exchange |
| CVE-2026-9743 | 6.5 MEDIUM | Aggregation sub-pipeline null dereference may allow DoS via crafted getMore |
| CVE-2026-9754 | 6.5 MEDIUM | Stack memory disclosure in filemd5 command |
| CVE-2026-9751 | 5.5 MEDIUM | Sensitive data could be written to mongod.log |
| CVE-2026-9735 | 5.5 MEDIUM | Keyfile contents are in MongoDB Server logs |
IV. Related Vulnerabilities
Same product: MongoDB Server
-
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads -
CVE-2026-82076
Integer Overflow in Query Planner Leads to Unbounded Memory -
CVE-2026-82075
Uncontrolled Resource Consumption in MongoDB Sharded Cluster -
CVE-2026-82074
Incorrect Authorization in MongoDB Server Aggregation Framew -
CVE-2026-82073
Improper Validation in MongoDB Server Aggregation Framework
Same vendor: MongoDB
-
CVE-2026-89099
Race Condition in MongoDB Server Document Value Layer Leads -
CVE-2026-88036
GridFS data disclosure and deletion via query-operator injec -
CVE-2026-88035
Heap buffer overflow via wrapped size check during SASL user -
CVE-2026-88034
GridFS data disclosure and deletion via query-operator injec -
CVE-2026-88033
GridFS data disclosure and deletion via query-operator injec
Same weakness: CWE-476
-
CVE-2026-57225
Suricata datasets: NULL pointer dereference in JSON/NDJSON d -
CVE-2026-93689
WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I -
CVE-2026-93588
ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM -
CVE-2026-93312
Freedesktop Poppler JBIG2Stream.cc rewind null pointer deref -
CVE-2026-76781
Libxml2: libxml2: null pointer dereference parsing nextcatal
V. Comments for CVE-2026-9752
No comments yet