DockerState

Home › Databases, caches and queues › mongo › 9.0

mongo:9.0

The MongoDB document database, tag 9.0, built on Ubuntu 26.04. Pushed to Docker Hub 5 days ago.

Critical 1High 28Medium 91Low 7Unknown 4Starts as root2 platforms

386 MBdownload (compressed)
1,120 MBunpacked on disk
9filesystem layers
366packages
5,260files
docker pull mongo:9.0mongo@sha256:452bdaf2127b8ff851e31410a267809b9829eded219979f2210e7c7efb85a058

Size per platform

Compressed download size on Docker Hub for each architecture.

  • amd64386 MB
  • arm64369 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

  • /usr/bin929 MB
  • /usr/lib96 MB
  • /usr/lib/x86_64-linux-gnu57 MB
  • /usr/sbin5.0 MB
  • /var/lib3.8 MB
  • /usr/share/doc2.7 MB
  • /usr/share/coreutils2.3 MB
  • /usr/local/bin1.8 MB
  • /var/cache1.7 MB
  • /usr/lib/apt942 kB

Layers

The 9 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

Full build steps
  1. 42 MBumoci raw add-layer --image /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/ubuntu:rockcraft-base /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/.temp_layer.9587.tar --tag 26.04
  2. 392 Bumoci raw add-layer --image /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/ubuntu:26.04 /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/.temp_layer.control_data.9587.tar
  3. 1 kBRUN /bin/sh -c set -eux; groupadd --gid 999 --system mongodb; useradd --uid 999 --system --gid mongodb --home-dir /data/db mongodb; mkdir -p /data/db /data/configdb; chown -R mongodb:mongodb /data/db /data/configdb # buildkit
  4. 1.5 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates jq numactl procps ; rm -rf /var/lib/apt/lists/* # buildkit
  5. 938 kBRUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends gnupg wget ; rm -rf /var/lib/apt/lists/*; dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; export GNUPGHOME="$(mktemp -d)"; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25B
  6. 116 BRUN /bin/sh -c mkdir /docker-entrypoint-initdb.d # buildkit
  7. 266 BRUN |2 MONGO_PACKAGE=mongodb-org MONGO_REPO=repo.mongodb.org /bin/sh -c echo "deb [ signed-by=/etc/apt/keyrings/mongodb.asc ] http://$MONGO_REPO/apt/ubuntu resolute/$MONGO_PACKAGE/$MONGO_MAJOR multiverse" | tee "/etc/apt/sources.list.d/$MONGO_PACKAGE.list" # buildkit
  8. 341 MBRUN |2 MONGO_PACKAGE=mongodb-org MONGO_REPO=repo.mongodb.org /bin/sh -c set -x && export DEBIAN_FRONTEND=noninteractive && apt-get update && apt-get install -y ${MONGO_PACKAGE}=$MONGO_VERSION ${MONGO_PACKAGE}-server=$MONGO_VERSION ${MONGO_PACKAGE}-shell=$MONGO_VERSION ${MONGO_PACKAGE}-mongos=$MONGO_VERSION ${MONGO_PACKAGE}-tools=$MONGO_VERSION ${MONGO_PACKAGE}-database=$MONGO_VERSION ${MONGO_PACKAGE}-database-tools-extra=$MONGO_VERSION && rm -rf /var/lib/apt/lists/* && rm -rf /var/lib/mongodb && mv /etc/mongod.conf /etc/mongod.conf.orig # buildkit
  9. 5 kBCOPY docker-entrypoint.sh /usr/local/bin/ # buildkit

Known vulnerabilities

1Critical1 with a fix
28High28 with a fix
91Medium33 with a fix
7Low3 with a fix
4Unknown3 with a fix

131 findings across 366 packages; 68 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

SeverityVulnerabilityAffected packagesFixed in
Critical CVE-2025-68121crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption stdlibinstalled v1.24.6 1.24.13, 1.25.7, 1.26.0-rc.3
High CVE-2025-61726golang: net/url: Memory exhaustion in query parameter parsing in net/url stdlibinstalled v1.24.6 1.24.12, 1.25.6
High CVE-2025-61729crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate stdlibinstalled v1.24.6 1.24.11, 1.25.5
High CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates stdlibinstalled v1.24.6 1.26.10, 1.27.3
High CVE-2026-25679net/url: Incorrect parsing of IPv6 host literals in net/url stdlibinstalled v1.24.6 1.25.8, 1.26.1
High CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries stdlibinstalled v1.24.6 1.25.11, 1.26.4
High CVE-2026-32280crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building stdlibinstalled v1.24.6 1.25.9, 1.26.2
High CVE-2026-32281crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation stdlibinstalled v1.24.6 1.25.9, 1.26.2
High CVE-2026-32283crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages stdlibinstalled v1.24.6 1.25.9, 1.26.2
High CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal stdlibinstalled v1.24.6 1.25.12, 1.26.5, 1.27.0-rc.2
High CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing stdlibinstalled v1.24.6 1.25.10, 1.26.3
High CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header stdlibinstalled v1.24.6 1.25.11, 1.26.4
High CVE-2026-56853net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56858html/template: golang: Go html/template: Cross-Site Scripting via pathological input stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56859encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56860net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-56862crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages stdlibinstalled v1.24.6 1.25.13, 1.26.6, 1.27.0-rc.3
High CVE-2026-59869js-yaml: js-yaml: Denial of Service via crafted YAML documents js-yamlinstalled 3.13.1 3.15.0, 4.3.0
High CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers stdlibinstalled v1.24.6 1.26.9, 1.27.2
High CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames stdlibinstalled v1.24.6 1.26.9, 1.27.2
High CVE-2026-84375js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing js-yamlinstalled 3.13.1 4.3.2, 3.15.2
High CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references stdlibinstalled v1.24.6 1.26.9, 1.27.2
High GHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported js-yamlinstalled 3.13.1 4.3.1, 3.15.1
Medium CVE-2025-47912net/url: Insufficient validation of bracketed IPv6 hostnames in net/url stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58183golang: archive/tar: Unbounded allocation when parsing GNU sparse map stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58185encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58187crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 stdlibinstalled v1.24.6 1.24.9, 1.25.3
Medium CVE-2025-58188crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-58189crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61723encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61724net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61725net/mail: Excessive CPU consumption in ParseAddress in net/mail stdlibinstalled v1.24.6 1.24.8, 1.25.2
Medium CVE-2025-61727golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs stdlibinstalled v1.24.6 1.24.11, 1.25.5
Medium CVE-2025-61728golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip stdlibinstalled v1.24.6 1.24.12, 1.25.6

Showing the 40 most severe of 118 distinct vulnerabilities (131 findings, one per affected package).

Packages

Go modules
234
Debian packages
131
npm packages
1

Image configuration

Base OS
Ubuntu 26.04
Default user
root (no USER set; the entrypoint may still drop privileges)
Entrypoint
docker-entrypoint.sh
Command
mongod
Exposed ports
27017/tcp
Image created
2026-10-26
amd64 digest
sha256:ce91889f87a369d312e50ecbc6c0b7f960e915bc4b69c4f6662402fa7011d242

Other MongoDB tags

mongo:8.0946 MB unpacked · 316 MB downloadC 1H 28M 67L 7? 4

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:ce91889f87a3. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.