MongoDBCVE-2026-82064
MongoDB Server: denial of service
High8.7CVE-2026-82064 · Published Sep 8, 2026 · updated Sep 16, 2026
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB Server Product | >= 8.3.0, < 8.3.9 | 8.3.9 |
| >= 8.0.0, < 8.0.30 | 8.0.30 | |
| >= 7.0.0, < 7.0.41 | 7.0.41 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-617
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 8 | MongoDB Server: weakly protected credentials | High7.1 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: denial of service | High7.2 | 8.3.9 |
| Sep 8 | MongoDB Server: improper authorization | High7.1 | 8.3.9 |
| Sep 8 | MongoDB Server: improper authorization | High7.1 | 8.0.30+1 more |
| Sep 8 | MongoDB Server: resource exhaustion | High8.7 | 8.3.9+2 more |
| Sep 8 | MongoDB Server: integer overflow | High7.1 | 8.3.9+2 more |