{"cve":"CVE-2026-9753","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.3.0,8.3.3)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.2.0,8.2.10)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.0.0,8.0.24)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[7.0.0,7.0.35)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"MongoDB Server","source":"cna","vendor":"MongoDB"},"product":"mongodb_server","vendor":"mongodb"}],"created":"2026-06-10T00:30:17.084693+00:00","updated":"2026-08-13T20:30:02.611265+00:00","vendors":["mongodb","mongodb$PRODUCT$mongodb_server"]},"epss":{"score":0.00298},"mitre":{"cpes":[],"created":"2026-06-09T22:30:57.171000+00:00","description":"The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"cvssV4_0":{"score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}},"mitre_repo_path":"cves/2026/9xxx/CVE-2026-9753.json","references":["https://jira.mongodb.org/browse/SERVER-124959"],"title":"Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.","updated":"2026-06-10T18:54:01.733000+00:00","vendors":[],"weaknesses":["CWE-1287"]},"nvd":{"cpes":["cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*"],"created":"2026-06-09T23:17:04.897000+00:00","description":"The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"cvssV4_0":{"score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2026/CVE-2026-9753.json","references":["https://jira.mongodb.org/browse/SERVER-124959"],"title":null,"updated":"2026-07-23T09:10:00.113000+00:00","vendors":["mongodb","mongodb$PRODUCT$mongodb"],"weaknesses":["CWE-1287","CWE-787"]},"opencve":{"changes":[{"created":"2026-06-09T23:00:00+00:00","data":[{"details":{"new":"The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.","old":null},"type":"description"},{"details":{"new":"Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.","old":null},"type":"title"},{"details":{"added":["CWE-1287"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://jira.mongodb.org/browse/SERVER-124959"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"cvssV4_0":{"score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"ea0e1990-8d7d-4b37-824d-be6061bdd068"},{"created":"2026-06-10T02:45:00+00:00","data":[{"details":["mongodb","mongodb$PRODUCT$mongodb_server"],"type":"first_time"},{"details":{"added":["mongodb","mongodb$PRODUCT$mongodb_server"],"removed":[]},"type":"vendors"}],"id":"9e055095-9200-4a58-911b-65c53d347a50"},{"created":"2026-06-10T19:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"2c117b74-a9cb-446e-8ad6-def1d9de5b6d"}],"cpes":{"data":["cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-06-09T22:30:57.171000+00:00","provider":"mitre"},"description":{"data":"The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{"score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},"provider":"mitre"},"epss":{"data":{"score":0.00298},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://jira.mongodb.org/browse/SERVER-124959"],"providers":["mitre","nvd"]},"title":{"data":"Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.","provider":"mitre"},"updated":{"data":"2026-06-10T18:54:01.733000+00:00","provider":"mitre"},"vendors":{"data":["mongodb","mongodb$PRODUCT$mongodb","mongodb$PRODUCT$mongodb_server"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-1287","CWE-787"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-06-09T22:30:57.171000+00:00","description":"The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.","updated":"2026-06-10T18:53:56.668000+00:00","vendors":[],"vulnrichment_repo_path":"2026/9xxx/CVE-2026-9753.json","weaknesses":[]}}