{"id":"CVE-2026-120809","kind":"vulnerability","aliases":["CVE-2026-120809"],"related":[],"title":"MongoDB: aggregation pipelines can read freed server memory or crash","description":"A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engine is enabled.","summary":"A use-after-free bug in MongoDB's SBE query engine, triggered by $unwind on time-series collections, can free memory that is still in use. An authenticated user can use this to read recycled server heap memory in query results or crash the server.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mongodb","runtime","self-hosted","time-series"],"not_affected_if":["default-config","no-time-series-collections"],"how_to_check":"- Check whether the non-default SBE-related server parameter is enabled on the deployment; the sources do not name it, so `unknown`\n- Check the running MongoDB version against the product ranges in the NVD entry: `unknown`","fix":null,"status":"open","published_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:48:02+00:00","updated_at":"2026-11-10T20:48:02+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T20:48:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB: aggregation pipelines can read freed server memory or crash","impact":"medium","summary":"A use-after-free bug in MongoDB's SBE query engine, triggered by $unwind on time-series collections, can free memory that is still in use. An authenticated user can use this to read recycled server heap memory in query results or crash the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","time-series"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server heap memory leaks into query results, or the server crashes","analyst_note":"Find the affected MongoDB version ranges, the name of the non-default SBE server parameter, and the fixed versions from the MongoDB advisory for CVE-2026-120809.","how_to_check":"- Check whether the non-default SBE-related server parameter is enabled on the deployment; the sources do not name it, so `unknown`\n- Check the running MongoDB version against the product ranges in the NVD entry: `unknown`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-time-series-collections"],"who_is_affected":"Only deployments with the non-default SBE-related server parameter enabled are exposed, and only users with an account who can run aggregation pipelines against time-series collections. Teams running default configuration or without time-series $unwind queries can likely skip it. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4645,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120809':13A,16A '-2026':12A,15A 'aggreg':2A,91C,130C 'authent':54B,125C 'base':86C 'bug':30B 'caus':109C 'collect':44B,99C 'condit':134C,138C 'craft':128C 'crash':10A,69B,149C 'cve':11A,14A 'default':161C 'downstream':115C 'enabl':170C 'engin':36B,88C,168C 'error':102C 'execut':87C 'exist':79C 'free':29B,46B,76C 'freed':6A,122C 'heap':63B,143C 'host':21B 'intern':101C 'issu':78C,153C 'logic':107C 'memori':8A,47B,64B,121C,144C 'mongodb':1A,17B,32B,81C 'non':160C 'non-default':159C 'paramet':163C 'pipelin':3A,92C,131C 'potenti':139C 'prematur':123C 'preserv':106C 'process':90C 'queri':35B,66B,146C 'read':5A,60B,77C,140C 'recycl':61B,141C 'referenc':113C 'relat':164C 'result':67B,147C 'runtim':18B 'sbe':34B,83C,167C 'self':20B 'self-host':19B 'seri':24B,43B,98C 'server':7A,62B,71B,142C,151C,162C 'slot':85C 'slot-bas':84C 'specif':133C 'stage':116C 'state':105C 'state-preserv':104C 'still':50B,112C 'time':23B,42B,97C 'time-seri':22B,41B,96C 'trigger':37B,136C,156C 'under':120C 'unwind':39B,94C 'use':27B,52B,57B,74C 'use-after-fre':26B,73C 'user':55B,126C 'valu':111C","nicknames":[],"mitigations":[],"who_affected":"Only deployments with the non-default SBE-related server parameter enabled are exposed, and only users with an account who can run aggregation pipelines against time-series collections. Teams running default configuration or without time-series $unwind queries can likely skip it. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mongodb","runtime","selfhosted","timeseries"],"campaign_type":null,"search_a":"'-120809':13A,16A '-2026':12A,15A 'aggreg':2A 'crash':10A 'cve':11A,14A 'freed':6A 'memori':8A 'mongodb':1A 'pipelin':3A 'read':5A 'server':7A","search_b":"'authent':54B 'bug':30B 'collect':44B 'crash':69B 'engin':36B 'free':29B,46B 'heap':63B 'host':21B 'memori':47B,64B 'mongodb':17B,32B 'queri':35B,66B 'read':60B 'recycl':61B 'result':67B 'runtim':18B 'sbe':34B 'self':20B 'self-host':19B 'seri':24B,43B 'server':62B,71B 'still':50B 'time':23B,42B 'time-seri':22B,41B 'trigger':37B 'unwind':39B 'use':27B,52B,57B 'use-after-fre':26B 'user':55B","search_c":"'aggreg':91C,130C 'authent':125C 'base':86C 'caus':109C 'collect':99C 'condit':134C,138C 'craft':128C 'crash':149C 'default':161C 'downstream':115C 'enabl':170C 'engin':88C,168C 'error':102C 'execut':87C 'exist':79C 'free':76C 'freed':122C 'heap':143C 'intern':101C 'issu':78C,153C 'logic':107C 'memori':121C,144C 'mongodb':81C 'non':160C 'non-default':159C 'paramet':163C 'pipelin':92C,131C 'potenti':139C 'prematur':123C 'preserv':106C 'process':90C 'queri':146C 'read':77C,140C 'recycl':141C 'referenc':113C 'relat':164C 'result':147C 'sbe':83C,167C 'seri':98C 'server':142C,151C,162C 'slot':85C 'slot-bas':84C 'specif':133C 'stage':116C 'state':105C 'state-preserv':104C 'still':112C 'time':97C 'time-seri':96C 'trigger':136C,156C 'under':120C 'unwind':94C 'use':74C 'use-after-fre':73C 'user':126C 'valu':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120809","severity":null,"published_at":"2026-11-10T20:18:51+00:00","modified_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}