VulnerabilityUndergoing Analysis

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case.

HIGH 7.1EPSS 0.41%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

CVSS 4.0: 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.41% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-617
Source: cna@mongodb.com

References

https://jira.mongodb.org/browse/SERVER-128341

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.