medium6.5
CVE-2026-9748
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed.
Impact
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Mongodb | from 7.0.0 before 7.0.35 from 8.0.0 before 8.0.10 from 8.2.0 before 8.2.10 from 8.3.0 before 8.3.3 |