CVE-2026-9748CWE-617

$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

High · published June 9, 2026

CVSS v4.0
7.1
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-06-09T22:08Z
EPSS history
Timeline
  • 09 JUN 22:08Z
    $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
    cvelistv5