CVE-2026-9740CWE-674

Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

High · published June 9, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-06-09T22:43Z
EPSS history
Timeline
  • 09 JUN 22:43Z
    Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
    cvelistv5