MongoDB Segmentation Fault Vulnerability via Invalid Compound Wildcard Index

A vulnerability exists in MongoDB that allows an authorized user to cause a segmentation fault, effectively disabling the server. This issue arises when a query is executed against a collection with an invalid compound wildcard index. The vulnerability is present in MongoDB versions 7.0, 8.0, and 8.2, as well as the current master branch.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing the MongoDB server to crash.

Reproduction

To reproduce this vulnerability, create a collection and insert a document. Then, create a compound wildcard index that improperly excludes the '_id' field. Afterward, execute a query that utilizes the index, which will result in a segmentation fault, crashing the server.

Remediation

Users can upgrade to MongoDB versions 8.3.0-rc0, 8.2.4, or 7.0.29 to address this vulnerability.