CVE-2026-96299: MongoDB Nested `$_internalSchemaAllElemMatchFromIndex` Cross-Product MatchExpression OOM
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.
Other sources
Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a sufficient limit on the resources used. This can cause memory use to grow until the mongod process runs out of memory and terminates. The behavior can occur when an authenticated user with read-only privileges runs an aggregation query that nests these operators.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with read-only privileges can trigger the behavior by running an aggregation query. No elevated write or administrative privileges are described as necessary.
What conditions are required for exploitation?
The attacker must be able to submit a user-supplied query filter containing nested internal schema validation operators and apply them to documents with arrays. The excessive memory use results from evaluation across combinations of array elements.
What is the likely operational impact?
Memory consumption can continue growing until the mongod process runs out of memory and terminates. The described impact is denial of service rather than disclosure or modification of data.
Are internal-only schema operators protected from user queries?
No. The affected behavior occurs because internal schema validation operators intended only for server use are accepted in user-supplied query filters.