{
  "cveId": "CVE-2026-9737",
  "url": "https://patchblox.com/security/cve/CVE-2026-9737",
  "summary": "CVE-2026-9737 is fixed in MongoDB on 1 platform by MongoDB 8.3.7 (version 8.3.7), released June 11, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Find command with $meta sort can lead to crash",
  "description": "During query planning when reading the sort pattern in raw BSONObj form, in some places we don\u2019t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.",
  "published": "2026-07-22T20:17:09Z",
  "severity": "",
  "cvss": 7.1,
  "cwe": "CWE-617: Reachable assertion",
  "epss": 0.0042,
  "epssPercentile": 0.36581,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2026-9737",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "MongoDB",
      "fixedVersion": "8.3.7",
      "fix": "MongoDB 8.3.7",
      "url": "https://patchblox.com/security/fix/windows-app/mongodb.server-8.3.7",
      "released": "2026-06-11T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}