What’s Vulnerable › Vulnerabilities

CVE-2024-8654: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-10 · updated 2026-06-17
• Weakness: CWE-908

Description

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

Affected products

• MongoDB: from 6.0.0 through 6.0.3

References

• https://jira.mongodb.org/browse/SERVER-71477
• https://security.netapp.com/advisory/ntap-20250516-0008/

Get alerted when CVE-2024-8654 or the next vulnerability affects your stack