Quick Look: CVE-2026-9740 — MongoDB Server BSON Validation Crash via Uncontrolled Mutual Recursion

Introduction

A single unauthenticated network packet can crash a MongoDB Server process, and the server's own recursion guard is powerless to stop it. CVE-2026-9740 is a flaw in how MongoDB's BSON validator tracks recursion depth across mutually recursive function calls. An attacker can use it to exhaust the call stack and terminate mongod before authentication ever takes place.

MongoDB's wire protocol has been a recurring source of pre-authentication security issues throughout 2025 and 2026, including the actively exploited MongoBleed vulnerability (CVE-2025-14847). MongoDB ranks among the top five most popular database systems globally, and the company reported $591.4 million in Q2 FY2026 revenue, so the potential blast radius of a pre-auth DoS flaw in mongod is substantial. Cato Networks estimated that a related pre-auth DoS vulnerability (CVE-2026-25611) put over 210,000 MongoDB instances at risk.

Technical Information

Root Cause: Mutual Recursion with Depth Counter Reset

BSON (Binary JSON) is MongoDB's primary data serialization format. MongoDB uses it both for document storage and for the wire protocol that clients use to talk to the server. Every incoming client message is encoded as a BSON document, and mongod must validate it before any further processing occurs.

The BSON specification supports multiple binary subtypes, some of which can contain embedded BSON documents. When the BSON validator meets a binary element that itself contains a BSON document, it recursively invokes a validation function. The flaw in CVE-2026-9740 is that this recursion is mutual rather than self-referential: one validation function (handling binary data) calls a second validation function (handling document structure), which in turn calls back to the first. The two functions form a cycle.

MongoDB's BSON validator does include a depth-tracking mechanism intended to prevent excessive recursion. According to the NVD description, however, "each re-entry resets internal depth tracking." The depth counter is zeroed or re-initialized on each mutual call, which negates the stack depth guard. The recursion proceeds unchecked until the process stack is exhausted, and the mongod process terminates with a segfault or stack overflow.

This flaw is classified under CWE-674: Uncontrolled Recursion, which MITRE defines as a weakness where "the product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack." CWE-674 notes that the primary consequence is denial of service: "resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash."

CVSS v4.0 Attack Profile

The CNA (MongoDB, Inc.) assessed this vulnerability with a CVSS v4.0 base score of 8.7 (High) using the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. The metrics break down as follows:

All confidentiality and integrity impact metrics are None, so the impact falls on availability alone.

Attack Flow

An attacker exploiting CVE-2026-9740 would follow this sequence:

1. Identify a reachable MongoDB instance. The default MongoDB wire protocol port is TCP 27017. No credentials or prior knowledge of the database contents are required.

2. Craft a malicious BSON message. The attacker constructs a BSON document containing nested binary elements with embedded BSON sub-documents, and structures the nesting so that the binary validation function and the document validation function call each other again and again. Because each re-entry resets the depth counter, the recursion guard never fires.

3. Send the message to the mongod process. The crafted BSON message travels over the MongoDB wire protocol. BSON validation happens during the initial message parsing phase, before any authentication or authorization checks.

4. Stack exhaustion and process termination. The mutual recursion consumes stack frames until the process stack is exhausted. The mongod process terminates with a segfault or stack overflow, a complete denial of service for every application that depends on that MongoDB instance.

5. Repeated exploitation. If the mongod process is configured to restart automatically (as is common in production deployments), the attacker can keep sending the crafted message and hold the service in a crash loop.

Pre-Authentication Attack Surface

Because BSON validation occurs before authentication, even MongoDB deployments that enforce strong authentication, TLS, and role-based access control are vulnerable to any attacker who can complete a TCP connection (and, if TLS is required, a TLS handshake) to the mongod port. The authentication check never executes, because the process crashes during message parsing.

Relationship to Other BSON and Wire Protocol Vulnerabilities

CVE-2026-9740 joins a run of BSON and wire protocol vulnerabilities in MongoDB Server:

CWE-674 appears in both CVE-2026-9740 and CVE-2025-6710, which suggests that MongoDB's codebase has insufficient recursion-depth controls across multiple input-parsing subsystems. Pre-authentication vulnerabilities also cluster in the wire protocol layer, and that concentration indicates a systemic weakness in input validation at the protocol boundary.

CWE-674 Mitigation at the Implementation Level

CWE-674 prescribes specific implementation-level mitigations. The primary fix is to make sure the recursion reaches an end condition under all logic conditions, for instance by checking the recursion depth against a safe limit and returning an error when that limit is exceeded. For CVE-2026-9740 specifically, the BSON validator must track depth across mutual recursion boundaries without resetting the counter on re-entry.

CWE-674 documentation rates increasing the program stack size as a workaround with only "Limited" effectiveness, because it "does not correct the underlying algorithmic flaw" and only delays the crash to higher nesting depths. MongoDB, Inc. has to apply these implementation-level fixes in the server code. Operators cannot implement them directly.

Affected Systems and Versions

As of the NVD publication date (June 9, 2026), the NVD record does not enumerate the specific MongoDB Server versions affected by CVE-2026-9740, and no patch versions have been identified in available sources. The sole external reference is the MongoDB JIRA issue SERVER-125063, which should contain authoritative version and fix details once updated.

Going by MongoDB's established patching pattern for similar vulnerabilities, the fix will likely ship as patch updates to the currently supported release lines (7.0, 8.0, 8.2, and 8.3). CVE-2025-14847, for example, was patched in MongoDB 8.0.17 and 7.0.28, and CVE-2026-25611 was patched across versions 7.0 through 8.2.4.

Organizations should monitor the MongoDB Alerts page and the SERVER-125063 JIRA issue for the official patch announcement.

Compensating Controls While Awaiting a Patch

Until a patch is available, these compensating controls can reduce exposure:

• Restrict network access to MongoDB ports. Do not expose TCP port 27017, or any custom port, to untrusted networks. Use firewall rules or cloud security groups to limit access to known application servers and administrative hosts. The CVSS vector confirms the attack is network-based (AV:N), so network segmentation directly reduces the attack surface.

• Implement IP allowlisting. MongoDB Atlas and self-managed deployments both support IP allowlists. Limiting which source IPs can connect shrinks the pool of potential attackers.

• Deploy connection rate limiting. It can help prevent rapid, repeated crash-restart cycles if an attacker attempts sustained exploitation.

• Require TLS. TLS does not stop an attacker who can complete a TLS handshake, but it raises the bar for blind exploitation and may let network monitoring tools detect anomalous connection patterns.

Vendor Security History

MongoDB's security record in 2025 and 2026 shows a concerning pattern of vulnerabilities in the server's wire protocol parsing layer. The OpenCVE database tracks 151 CVEs associated with the MongoDB vendor.

The most significant recent vulnerability was CVE-2025-14847, dubbed "MongoBleed," disclosed on December 12, 2025. It affected MongoDB Server versions 3.6 through 8.2 and let unauthenticated remote attackers read uninitialized heap memory, because of a mismatch in how zlib-compressed protocol header lengths were handled. Both Bitsight and Wiz confirmed that CVE-2025-14847 was actively exploited in the wild. The Canadian Centre for Cyber Security issued alert AL25-021 in response. MongoDB patched it in versions 7.0.28, 8.0.17, and 8.2.x.

February 2026 brought CVE-2026-25611, another pre-authentication denial of service, this time through memory exhaustion. Cato Networks estimated that over 210,000 MongoDB instances were at risk.

CVE-2025-6710, a JSON parsing stack overflow also classified under CWE-674, showed the same class of uncontrolled recursion flaw in a different parsing subsystem. With CWE-674 recurring across multiple components, it is fair to ask whether earlier security audits should have caught the recursion depth reset pattern before it reached production code.

MongoDB, Inc. is its own CVE Numbering Authority (CNA), as the source field [email protected] in the CVE-2026-9740 record shows. This self-reporting model provides timely disclosure but relies on the vendor's thoroughness in identifying and reporting flaws across its codebase.

The progression from MongoBleed (confirmed exploited, December 2025) to CVE-2026-25611 (February 2026) to CVE-2026-9740 (June 2026) shows MongoDB wire protocol vulnerabilities being discovered at an accelerating pace. Each new pre-auth vulnerability makes it more likely that threat actors maintain active MongoDB scanning and exploitation tooling.

References

• NVD: CVE-2026-9740
• MongoDB JIRA: SERVER-125063
• MongoDB Alerts
• CWE-674: Uncontrolled Recursion
• CISA Known Exploited Vulnerabilities Catalog
• Bitsight: CVE-2025-14847 MongoDB "MongoBleed"
• Wiz: MongoBleed (CVE-2025-14847) Exploited in the Wild
• Canadian Centre for Cyber Security: AL25-021
• Palo Alto Unit 42: Threat Brief on CVE-2025-14847
• Cato Networks: CVE-2026-25611 MongoDB Vulnerability
• SentinelOne: CVE-2026-25611
• OpenCVE: MongoDB CVEs
• NVD: CVE-2025-14847
• NVD: CVE-2026-6231