SB2026051615 - Multiple vulnerabilities in MongoDB Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051615

SB2026051615 - Multiple vulnerabilities in MongoDB Server

Published: May 16, 2026 Updated: August 18, 2026

Security Bulletin ID SB2026051615
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 17% Low 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2026-8053)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to an out-of-bounds write in the time-series bucket catalog when inserting data with duplicate field names into time-series collections. A remote user can insert specially crafted data to execute arbitrary code.

The issue results from an inconsistency in the internal field-name-to-index mapping.


2) Improperly Controlled Sequential Memory Allocation (CVE-ID: CVE-2026-8199)

CWE-ID: CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improperly controlled sequential memory allocation in bitwise match expression AST processing when processing $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear expressions. A remote user can send crafted queries using these operators to cause a denial of service.

The issue can cause excess memory usage, contributing to memory pressure and potential out-of-memory conditions.


3) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-8200)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the schema validation log message handling when processing update or insert operations that violate a collection schema. A remote privileged user can submit data that triggers a schema validation failure to disclose sensitive information.

Only collections with schema validation enabled are affected.


4) Use-after-free (CVE-ID: CVE-2026-8201)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service and disclose sensitive information.

The vulnerability exists due to use-after-free in the Field-Level Encryption (FLE) query analysis component when processing positional projections on encrypted fields in FLE-related queries. A remote user can send a specially crafted FLE-related query to cause a denial of service and disclose sensitive information.

The issue affects client-side uses of mongocryptd and crypt_shared, and exploitation requires control over the structure of a client's FLE-related query.


5) Use-after-free (CVE-ID: CVE-2026-8336)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in $_internalJsEmit and mapreduce commands when invoking $_internalJsEmit or the mapreduce command's map function in a certain way and subsequently using the server-side JavaScript engine. A remote user can invoke these command paths in a crafted sequence to cause a denial of service.

The issue is triggered when server-side JavaScript features such as $where, $function, or the mapreduce reduce stage are later used in a specific way.


6) Resource exhaustion (CVE-ID: CVE-2026-8202)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the $trim, $ltrim, and $rtrim aggregation operators when processing a densely populated chars mask and a large input string. A remote user can submit a crafted aggregation expression to cause a denial of service.

Exploitation requires aggregation permissions.


Remediation

Install update from vendor's website.

References