CVE-2026-8336: DoS in MongoDB Server 7.0-8.3.2
Plattform
mongodb
Komponente
mongodb-server
Behoben in
8.3.2
CVE-2026-8336 is a denial-of-service (DoS) vulnerability affecting MongoDB Server. An authenticated user can trigger a crash in the mongod process by exploiting the server-side JavaScript engine through improper use of $_internalJsEmit, mapreduce commands, or other JavaScript-related features. This results in a server crash, leading to data unavailability and service disruption. The vulnerability impacts MongoDB Server versions 7.0.0 through 8.3.2 and is resolved in version 8.3.2.
Auswirkungen und Angriffsszenarien
The impact of CVE-2026-8336 is a severe denial-of-service. A successful exploitation leads to a complete crash of the MongoDB server process, resulting in immediate data unavailability and service interruption. This can have significant consequences for applications and services reliant on the database. The vulnerability requires authentication, but the potential for a complete server crash makes it a high-priority concern. The blast radius is limited to the affected MongoDB instance, but the impact can be catastrophic if the database is critical. This vulnerability shares similarities with other JavaScript engine exploitation patterns that have led to remote code execution in other systems.
Ausnutzungskontext
CVE-2026-8336 was published on 2026-05-13. The vulnerability's severity is assessed as High (CVSS 7.5). No public proof-of-concept exploits are currently known. The EPSS score is pending evaluation. There are no indications of active exploitation campaigns targeting this vulnerability at this time. Refer to the MongoDB security advisory for further details.
Bedrohungsanalyse
Exploit-Status
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Hoch — erfordert eine Race-Condition, Nicht-Standard-Konfiguration oder spezifische Umstände.
- Privileges Required
- Niedrig — jedes gültige Benutzerkonto ist ausreichend.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Hoch — vollständiger Vertraulichkeitsverlust. Angreifer kann alle Daten lesen.
- Integrity
- Hoch — Angreifer kann beliebige Daten schreiben, ändern oder löschen.
- Availability
- Hoch — vollständiger Absturz oder Ressourcenerschöpfung. Totaler Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Veröffentlicht
Mitigation und Workarounds
The primary mitigation for CVE-2026-8336 is to upgrade MongoDB Server to version 8.3.2 or later. If immediate upgrading is not possible, restrict access to the $_internalJsEmit function and carefully review the usage of mapreduce commands and other JavaScript-related features. Implement strict input validation on any user-supplied data used within JavaScript expressions. Monitoring the MongoDB server for unexpected crashes or errors is crucial. Web Application Firewalls (WAFs) or proxies might be configured to inspect and block suspicious JavaScript code, but this is complex. After upgrading, confirm the fix by attempting to reproduce the vulnerability with known malicious JavaScript code; the server should not crash.
So behebenwird übersetzt…
Actualice su instancia de MongoDB Server a la versión 7.0.34, 8.0.23, 8.2.9 o 8.3.2 o superior para mitigar la vulnerabilidad de denegación de servicio. La actualización corrige un error de uso después de liberar que puede ser explotado por usuarios autenticados para causar un fallo en el servidor. Consulte la documentación oficial de MongoDB para obtener instrucciones detalladas sobre cómo actualizar.
Häufig gestellte Fragen
What is CVE-2026-8336?
It's a denial-of-service vulnerability in MongoDB Server that allows authenticated users to crash the server by misusing the JavaScript engine.
Am I affected?
If you're running MongoDB Server versions 7.0.0 through 8.3.2, you are potentially affected. Upgrade to 8.3.2 to resolve the issue.
How to fix it?
Upgrade MongoDB Server to version 8.3.2 or later. Restrict access to $_internalJsEmit and validate JavaScript input.
Is it being exploited?
Currently, there are no known public exploits or active campaigns targeting this vulnerability.
Where can I learn more?
Refer to the official MongoDB security advisory for detailed information and updates: [https://www.mongodb.com/docs/manual/release-notes/8.3.2/](https://www.mongodb.com/docs/manual/release-notes/8.3.2/)
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...