CVE-2021-32040: Large aggregation pipelines with a specific stage can crash mongod under default configuration

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-12 · updated 2026-06-17
Weakness: CWE-121

Description

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB Server v4.4 versions prior to and including 4.4.28, MongoDB Server v5.0 versions prior to 5.0.4 and MongoDB Server v4.2 versions prior to 4.2.16. Workaround: >= v4.2.16 users and all v4.4 users can add the --setParameter internalPipelineLengthLimit=50 instead of the default 1000 to mongod at startup to prevent a crash.

Affected products

MongoDB: from 4.2.0 before 4.2.16; from 4.4.0 before 4.4.11; from 5.0.0 before 5.0.4 — fixed in 4.2.16, 4.4.11, 5.0.4

How to fix

Upgrade to a fixed version: MongoDB 4.2.16, 4.4.11, 5.0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32040 or the next vulnerability affects your stack