CVE-2026-9740EPSS p42.8%

CVE-2026-9740CVE-2026-9740

mongodb / mongodb

Description

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

Scoring

CVSS 7.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS0.53% probability of exploitation · percentile 42.8% · 2026-10-05T12:00:23Z
Last modified2026-07-23

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-9750
CVE
CVE-2026-9743
CVE
CVE-2026-8053
CVE
CVE-2025-6706
CVE
MongoDB mongo-express Remote Code Execution Vulnerability
CVE
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.