MongoDB 5.0, end of life since 31 October 2024
MongoDB 5.0.34 vulnerabilities
MongoDB 5.0.34 is the last release of the 5.0 branch, end of life since 31 October 2024. The US National Vulnerability Database lists 1 vulnerability for this version, none of them critical. MongoDB fixes flaws only in supported versions.
- 1known vulnerabilities
- 0critical
- 1high
- 0exploited in the wild
What you can do
Keep MongoDB 5.0.34, patched
We backport the security fixes to the MongoDB version you run on your own servers, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported MongoDB version once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 1 known vulnerability in MongoDB 5.0.34
US National Vulnerability Database, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where NVD records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2026-9753 | 8.1 | High | 2026-06-09 | 7.0.35 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command. |