CVE-2026-9737 — Find command with $meta sort can lead to crash

CVE-2026-9737

Find command with $meta sort can lead to crash PUBLISHED

Description (CNA)

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 7.0 before 7.0.39; affected 8.0 before 8.0.28; affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-617

References

https://jira.mongodb.org/browse/SERVER-128341

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.