https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T09:49:28.116492+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-9748 CVE-2026-9748 — $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input 2026-10-07T09:49:28.135339+00:00

Affected: MongoDB Server

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

 https://cve.radiocsirt.org/vuln/ghsa-7r4j-g3f5-3629 GHSA-7r4j-g3f5-3629 2026-10-07T09:49:28.135435+00:00

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.