MongoDB heap-use-after-free in $internalApplyOplogUpdate fixed in 9.1.0-rc0

Vulnerability Overview Vulnerability Name: Heap-use-after-free in $internalApplyOplogUpdate stage when reading via getMore after aggregate invocation is destroyed Type: Bug Priority: Major - P3 Status: Closed Fixed Version: 9.1.0-rc0 Impact Scope Affected Versions: None Component: None Tags: bkp, task:finding Operating System: ALL Backend Versions: v9.0, v8.3, v8.0, v7.0 LinkBF Score: 200 CAR Domain: None Remediation Fix Status: Fixed Fixed Version: 9.1.0-rc0 Detailed Description Description: - When the initial aggregation returns a cursor and its command, the $internalApplyOplogUpdate aggregation stage holds an unnamed reference to the oplog batch. If this batch is destroyed, the buffer is freed. Subsequent operations dereference the freed memory, resulting in a heap-use-after-free error. - This issue was captured in the view timeline injection test of . In this test, the $internalApplyOplogUpdate stage and the secondary-read-pass-through routing to aggregation on the secondary node caused a crash during . The client observed a (513) error via mongos. Root Cause: - In , an object (unnamed) is declared whose points to a freed oplog batch. Additional Information Created: Aug 05 2026 03:04:02 PM UTC Updated: Oct 13 2026 03:42:43 PM UTC Resolved: Sep 10 2026 03:04:27 PM UTC Personnel Information Assignee: Matt Olson Reporter: Matt Olson Participants: Github User, (2) Votes: 0 Watchers: 0 Page Permissions Permission Notice: Unable to login to Jira; authentication is required to perform this action. Code Block POC Code: None Summary This vulnerability involves a heap-use-after-free error caused by the destruction of an unnamed referenced oplog batch when reading the aggregation stage via . It affects all operating systems and has been fixed in version 9.1.0-rc0.

Goal Reached Thanks to every supporter — we hit 100%!

MongoDB heap-use-after-free in $internalApplyOplogUpdate fixed in 9.1.0-rc0