Percona Server for MongoDB 7.0.45-24 (2026-10-21)¶

Installation Upgrade from MongoDB Community

We are pleased to announce Percona Server for MongoDB 7.0.45-24, the drop-in replacement for MongoDB Community Edition. It supports MongoDB Community protocols and drivers and enhances it with enterprise-grade features for free, helping you meet your organization’s requirements for high availability, reliability, and data security.

This release includes the improvements and bug fixes of:

MongoDB 7.0.45 Community Edition .
Supports protocols and drivers of MongoDB Community 7.0.45.

Important

Percona Server for MongoDB 7.0.45-24 contains fixes for:

You can find details at the bottom of this page.

Release highlights¶

MongoDB Database Tools are distributed as a separate tarball¶

Starting with this release, MongoDB Database Tools (mongodump, mongorestore, mongoexport, mongoimport, and others) are no longer included in the Percona Server for MongoDB binary tarball. If you install Percona Server for MongoDB from tarballs, download the MongoDB Database Tools tarball separately from the Percona Downloads website.

This change aligns the distribution of MongoDB Database Tools with how MongoDB Shell (mongosh) is already distributed. It also allows us to deliver tool updates, including security fixes, independently of the server releases.

If you install Percona Server for MongoDB from RPM or DEB packages, nothing changes for you: MongoDB Database Tools are installed as before.

Upgrade recommendation¶

This release fixes multiple security vulnerabilities inherited from upstream MongoDB. We strongly recommend upgrading to version 7.0.45-24 as soon as possible.

Changelog¶

Improvements¶

PSMDB-1944: MongoDB Database Tools packages are now built independently of Percona Server for MongoDB packages. This allows tool updates, including security fixes, to be prepared without rebuilding the server packages.
PSMDB-2182: Improved telemetry for x.509 certificate authentication. x.509 is used by default for internal authentication between members of replica sets and sharded clusters, so telemetry previously reported it as enabled on almost every instance. Telemetry now reports x.509 usage for client authentication separately from its use for internal cluster authentication.

Bugs fixed¶

PSMDB-2126: Fixed an issue where streaming a backup to Google Cloud Storage through its S3-compatible API failed. The issue was caused by the upgrade of the AWS SDK for C++ to version 1.11.471, which added empty checksum elements to multipart upload requests that Google Cloud Storage rejects.

Improvements and bug fixes from upstream MongoDB¶

The MongoDB 7.0.45 patch release notes include the following bug fixes. Security fixes are listed separately below.

Bugs fixed¶

SERVER-104343 : Fixed an assertion failure during initial sync when unsupportedSyncSource selected a primary despite a secondary-only read preference.
SERVER-107966 : Fixed an issue that could leave a ping monitor in the replica set monitor disabled, preventing updates to the server’s round-trip time (RTT).
SERVER-119766 : Fixed a data race caused by concurrent reads and writes to the oplogFetcherHighestFetchedOptime metric.
SERVER-128392 : Fixed an issue where inserting a document with a duplicate _id containing a Decimal128 value into a clustered collection returned a KeyString format error instead of a duplicate key error.
SERVER-132246 : Fixed an issue where the default value of minWaitForStreamingHelloMillis prevented drivers from working with short heartbeat intervals and connection timeouts. The default is now 500 milliseconds.

Security fixes from upstream MongoDB¶

The severity categories below follow the upstream CVSS scores .

Medium severity¶

SERVER-132946 (CVE-2026-96297 ): A use-after-free issue in the $_internalApplyOplogUpdate aggregation stage could expose unrelated data from server memory in query results. An authenticated user with read privileges could trigger the issue by combining the stage with a batch size of 0. The server process could also terminate unexpectedly.
SERVER-134618 (CVE-2026-103965 ): An issue in the $bucket aggregation stage could cause constant values to be interpreted as field references during internal query rewriting. Under certain conditions, an authenticated user with read access could receive field values that the query did not intend to return.

For the complete upstream changelog, see MongoDB 7.0.45 Community Edition .

Tools packaged with this release¶

Tool	Base version	Release notes
MongoDB Shell (`mongosh`)	2.13.0	upstream release notes
Mongo Tools	100.19.1	upstream release notes