CVE-2026-8199: Memory Exhaustion in MongoDB Server 8.3.2
Plattform
mongodb
Komponente
mongodb
Behoben in
8.3.2
CVE-2026-8199 is a medium-severity vulnerability in MongoDB Server that allows an authenticated user to trigger excessive memory usage. This occurs through the processing of bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear). The resulting memory pressure can lead to an Out-of-Memory (OOM) condition, resulting in availability loss. Affected versions include MongoDB Server v7.0 prior to 7.0.34, v8.0 prior to 8.0.23, v8.2 prior to 8.2.9, and v8.3 prior to 8.3.2. A fix is available in version 8.3.2.
Auswirkungen und Angriffsszenarien
An attacker exploiting CVE-2026-8199 can induce a denial-of-service (DoS) condition by crafting queries that utilize bitwise match expressions in a way that consumes excessive memory. This can lead to the MongoDB server running out of memory and becoming unresponsive, impacting all applications and services relying on the database. The impact is primarily focused on availability, but prolonged outages can also lead to data loss or corruption if replication is not properly configured. The vulnerability requires authentication, but the ease of crafting such queries makes it a potential risk, especially in environments with less stringent query validation.
Ausnutzungskontext
CVE-2026-8199 was published on 2026-05-13. Its CVSS score is 6.5 (MEDIUM). No public Proof-of-Concept (POC) exploits have been publicly disclosed as of this writing. The EPSS score is pending evaluation. Monitor security advisories from MongoDB and CISA for updates on exploitation activity and potential mitigation strategies.
Bedrohungsanalyse
Exploit-Status
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Niedrig — jedes gültige Benutzerkonto ist ausreichend.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Keine — kein Integritätseinfluss.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Veröffentlicht
Mitigation und Workarounds
The recommended mitigation for CVE-2026-8199 is to upgrade MongoDB Server to version 8.3.2 or later. As a temporary workaround, consider limiting the complexity of queries that utilize bitwise match expressions. Implement resource limits on MongoDB processes to prevent excessive memory consumption. Monitor MongoDB server memory usage and set up alerts for high memory utilization. Consider using a Web Application Firewall (WAF) to filter or block queries that are likely to trigger the vulnerability. After upgrading, confirm the fix by running a query known to trigger the vulnerability and verifying that memory usage remains within acceptable limits.
So behebenwird übersetzt…
Actualice su instancia de MongoDB Server a la versión 7.0.34, 8.0.23, 8.2.9 o 8.3.2 o superior para mitigar el riesgo de agotamiento de memoria. Esta actualización aborda la vulnerabilidad al corregir el procesamiento de expresiones de coincidencia de bits, previniendo el uso excesivo de memoria y posibles denegaciones de servicio.
Häufig gestellte Fragen
What is CVE-2026-8199?
It's a medium-severity vulnerability in MongoDB Server that allows authenticated users to cause excessive memory usage via bitwise match expressions, potentially leading to a denial of service.
Am I affected?
If you're running MongoDB Server versions 7.0.0–8.3.2, you are potentially affected. Upgrade to the latest version.
How do I fix it?
Upgrade to MongoDB Server version 8.3.2 or later. Consider limiting query complexity as a temporary workaround.
Is it being exploited?
No public exploits are currently known, but the vulnerability's potential impact warrants immediate attention.
Where can I learn more?
Refer to the MongoDB security advisory and the NVD entry for CVE-2026-8199 for detailed information.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...