CVE-2026-9749: MongoDB

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.

Affected products

• MongoDB MongoDB: from 7.0.0, before 7.0.35 (fixed in 7.0.35); from 8.0.0, before 8.0.24 (fixed in 8.0.24); from 8.2.0, before 8.2.10 (fixed in 8.2.10); from 8.3.0, before 8.3.3 (fixed in 8.3.3)

Published 2026-06-09. Last modified 2026-07-23.