Vulnerabilities

An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources.

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take.

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.