8.1Alta

CVE-2026-82061Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service

MongoDB MongoDB Server Publicada: 2026-09-08 19:12 (hace 2 meses)

Descripción

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

Debilidad (CWE): CWE-416

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
mongodb	mongodb	8.3.0 – < 8.3.9
MongoDB	MongoDB Server	8.3.0 – < 8.3.9

Referencias y parches

https://jira.mongodb.org/browse/SERVER-130907 Vendor AdvisoryIssue Tracking

Coincidencias CPE (NVD) (1)

cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* ≥ 8.3.0 < 8.3.9

Puntuación CVSS

8.1Alta

Fuente: mongodb · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Ninguno
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Todas las puntuaciones (4)

cna	CVSS 4.0	7.2Alta
cna	CVSS 3.1	8.1Alta
cna@mongodb.com	CVSS 4.0	7.2Alta
cna@mongodb.com	CVSS 3.1	8.1Alta

EPSS (probabilidad de explotación en 30 días)

0.53%

superior al 45 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-08-27
Publicada2026-09-08 19:12
Llegó a IP-DB2026-10-24 23:50
Última actualización2026-09-16 23:36

Asignada por (CNA): mongodb
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — MongoDB

4.3Media

CVE-2026-120819 hace 4 días

Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

MongoDB MongoDB Server

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted da…

9.0Crítica

CVE-2026-118383 hace 4 días

Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

MongoDB MongoDB Server

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpec…

7.5Alta

CVE-2026-120828 hace 4 días

Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage

MongoDB MongoDB Server

A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these record…

6.5Media

CVE-2026-120826 hace 4 días

Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access

MongoDB MongoDB Server

An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checki…

6.5Media

CVE-2026-120825 hace 4 días

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

MongoDB MongoDB Server

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege e…

8.8Alta

CVE-2026-120824 hace 4 días

Post-authentication use-after-free in MongoDB Server time-series bucket validation

MongoDB MongoDB Server

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directl…