MongoDB $facet Crash via PauseExecution misuse in aggregation pipeline
CVE-2026-9748 Published on June 9, 2026
$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
Vulnerability Analysis
CVE-2026-9748 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is an assertion failure Vulnerability?
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVE-2026-9748 has been classified to as an assertion failure vulnerability or weakness.
Products Associated with CVE-2026-9748
Want to know whenever a new CVE is published for MongoDB? stack.watch will email you.
Affected Versions
MongoDB Server:- Version 8.3.0 and below 8.3.3 is affected.
- Version 8.2.0 and below 8.2.10 is affected.
- Version 8.0.0 and below 8.0.10 is affected.
- Version 7.0.0 and below 7.0.35 is affected.