7.1
/ 10
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.
Basic Information
ID
CVE-2026-9746
Source
mongodb
Published
Jun 9, 2026 at 22:02
Affected Product
Vendor
MongoDB
Product
MongoDB Server
Version
8.3.0
Affected Versions
MongoDB MongoDB Server 8.3.0
MongoDB MongoDB Server 8.2.0
MongoDB MongoDB Server 8.0.0
MongoDB MongoDB Server 7.0.0
MongoDB MongoDB Server 8.2.0
MongoDB MongoDB Server 8.0.0
MongoDB MongoDB Server 7.0.0