CVE-2026-9752: GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS.
Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not create 2dsphere indexes on fields that may contain GeoJSON GeometryCollection documents which include a Polygon with strict-winding winding order. Remove or refrain from adding such indexes until an upstream fix is available.
MongoDB 2dsphere index indexing of GeometryCollection containing strict-winding Polygon = disabled - Compensating control
Restrict privileges to create or modify 2dsphere indexes and limit who can run queries that trigger 2dsphere index key generation to trusted administrators until a fix is applied.
- Operational
Scan stored GeoJSON data for GeometryCollection documents that include a Polygon with a strict-winding winding order and remove or normalize those Polygon members (or the containing GeometryCollection) before creating or using 2dsphere indexes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9752?
The severity of CVE-2026-9752 is rated as medium with a CVSS score of 6.5.
How do I fix CVE-2026-9752?
To fix CVE-2026-9752, ensure that strict-winding polygons are not used in 2dsphere index queries.
What type of attack does CVE-2026-9752 allow?
CVE-2026-9752 allows an authorized user to cause a server crash by executing specific queries on 2dsphere indexes.
Which software is affected by CVE-2026-9752?
CVE-2026-9752 affects MongoDB Server.
What is the impact of CVE-2026-9752 on the system?
The impact of CVE-2026-9752 is a potential server crash when handling specific queries with 2dsphere indexing.