CVE-2026-9740: Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable MongoDB access control so clients must authenticate before sending requests (enable authorization/access control in mongod configuration) to prevent unauthenticated users from sending messages that could crash the server.
MongoDB Server (mongod) authentication/authorization = enabled - Configuration
Configure mongod to bind only to localhost or internal/trusted IP addresses (limit network.bindIp) so untrusted remote hosts cannot connect and send messages to the server.
MongoDB Server (mongod) bindIp / network exposure = restrict to localhost or trusted networks - Compensating control
Apply network-level controls (firewall rules, network ACLs, VPN, or WAF) to restrict access to the MongoDB server port from untrusted networks and only allow trusted management hosts to connect.
- Operational
Monitor mongod processes and logs for crashes or unexpected restarts; investigate and block sources of malicious or malformed messages. Restart affected instances as needed and collect crash dumps for analysis.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9740?
The severity of CVE-2026-9740 is classified as high with a score of 7.5.
What does CVE-2026-9740 affect?
CVE-2026-9740 affects MongoDB Server by exploiting the BSON validation logic.
How do I fix CVE-2026-9740?
To fix CVE-2026-9740, update your MongoDB Server to the latest version that addresses this vulnerability.
What type of attack does CVE-2026-9740 allow?
CVE-2026-9740 allows an unauthenticated user to crash the mongod process by sending a specially crafted message.
What is the primary impact of CVE-2026-9740?
The primary impact of CVE-2026-9740 is a pre-authentication stack overflow due to unbounded recursion in BSON validation.