CVEvulnerability

CVE-2026-82054

7.1 HIGH Published 2026-09-08 Modified 2026-09-16 Official page ↗
Status
Analyzed
Published
2026-09-08
Last modified
2026-09-16
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770

Description

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Affected configurations

• mongodb mongodb (>= 7.0.0 < 7.0.41) • mongodb mongodb (>= 8.0.0 < 8.0.30) • mongodb mongodb (>= 8.2.0 <= 8.2.12) • mongodb mongodb (>= 8.3.0 < 8.3.9) • mongodb mongodb 9.0.0 • mongodb mongodb 9.1.0

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References