AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBCVE-2026-82054

MongoDB Server: resource exhaustion

MongoDB

CVE-2026-82054 · Published Sep 8, 2026 · updated Sep 16, 2026

High7.1
Fix: upgrade to 8.3.9 or later (3 fixed versions below)
MongoDB advisory

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Affected versions

PackageAffectedFixed in
MongoDB Server
Product
>= 8.3.0, < 8.3.98.3.9
>= 8.0.0, < 8.0.308.0.30
>= 7.0.0, < 7.0.417.0.41
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More MongoDB advisories

All MongoDB