CVE-2026-9752: GeoJSON GeometryCollection DoS Vulnerability

CVE-2026-9752 Overview

CVE-2026-9752 is a null pointer dereference vulnerability in MongoDB Server's geospatial query handling. An authorized user can crash the server by issuing a query against a 2dsphere index on a field containing a GeoJSON GeometryCollection. When that collection includes a Polygon with a strict-winding Coordinate Reference System (CRS), the server reaches an unsafe code path and dereferences a null pointer. The flaw maps to [CWE-476: NULL Pointer Dereference] and produces a denial-of-service condition against the database process.

Critical Impact
An authenticated attacker with query privileges can terminate the MongoDB server process, disrupting availability for all connected applications.

Affected Products

MongoDB Server deployments using 2dsphere indexes on GeoJSON fields
Replica set and sharded cluster nodes processing affected geospatial queries
Applications routing user-influenced GeoJSON content into indexed collections

Discovery Timeline

2026-06-09 - CVE-2026-9752 published to the National Vulnerability Database
2026-06-10 - Entry last modified in NVD

Technical Details for CVE-2026-9752

Vulnerability Analysis

The defect resides in MongoDB's geospatial indexing validation logic. The server intentionally rejects polygons that use a strict-winding CRS for 2dsphere indexing because such polygons require semantics the indexer does not support. The validation guard inspects top-level geometries but does not recurse into the members of a GeometryCollection. A strict-winding Polygon nested inside a GeometryCollection therefore bypasses the rejection logic.

Once the unsafe path executes, the indexer attempts to operate on geometry state that was never properly initialized for strict-winding handling. The resulting null pointer dereference terminates the mongod process. Recovery requires automated process restart or manual intervention, and replica set failover can cascade while the primary restarts.

Root Cause

The guard that filters unsupported strict-winding polygons performs a shallow check. It evaluates the geometry type of the input but does not walk the geometries array of a GeometryCollection. This incomplete validation allows a disallowed inner polygon to reach code that assumes the guard has already rejected it, leaving a required pointer uninitialized.

Attack Vector

Exploitation requires network access to the MongoDB instance and authenticated credentials with query privileges against a collection that has a 2dsphere index. The attacker writes or queries a document whose indexed field contains a GeometryCollection enclosing a Polygon with a strict-winding CRS extension. When the query planner consults the 2dsphere index, the server crashes. No additional user interaction is required.

No verified public exploit code is available. Technical context is published in the MongoDB Server Issue Tracker.

Detection Methods for CVE-2026-9752

Indicators of Compromise

Unexpected mongod process termination correlated with geospatial query execution
Repeated replica set primary step-downs or election events without infrastructure cause
Application logs showing failed queries against collections with 2dsphere indexes immediately before server restart

Detection Strategies

Inspect MongoDB query logs for documents and queries containing GeometryCollection objects that embed a Polygon with a crs member referencing strict-winding semantics
Audit collections for 2dsphere indexes and review write paths that allow user-controlled GeoJSON input
Correlate mongod crash signals with the last executed operation captured in the diagnostic data capture (diagnostic.data) directory

Monitoring Recommendations

Alert on abnormal mongod exit codes and process restarts via systemd or the orchestrator in use
Track query error rates and latency anomalies against collections with 2dsphere indexes
Forward MongoDB audit logs to a centralized analytics platform for query pattern review

How to Mitigate CVE-2026-9752

Immediate Actions Required

Apply the fixed MongoDB Server release referenced in SERVER-123440 once available for your branch
Restrict query and write permissions on collections holding 2dsphere indexes to trusted service accounts only
Validate GeoJSON input at the application layer and reject documents containing GeometryCollection members with a strict-winding crs

Patch Information

MongoDB tracks the fix under issue SERVER-123440. Refer to the MongoDB Server Issue Tracker for the resolved versions and backport status across supported release branches. Upgrade affected replica set members and shard nodes following standard rolling-upgrade procedures.

Workarounds

Drop or temporarily disable 2dsphere indexes on collections that accept untrusted GeoJSON until the patch is deployed
Enforce a server-side or application-side schema that disallows the crs property within nested GeometryCollection geometries
Limit role grants so that only vetted service accounts can execute geospatial queries against indexed fields

bash

# Application-layer validation example: reject strict-winding CRS inside GeometryCollection
# Pseudocode - adapt to your stack
if document.geo.type == "GeometryCollection":
    for g in document.geo.geometries:
        if g.type == "Polygon" and g.get("crs", {}).get("properties", {}).get("name", "").endswith("strictwinding"):
            raise ValueError("Strict-winding CRS not permitted in indexed GeoJSON")