Denial of Service Vulnerability in MongoDB Server Affecting Multiple Versions

CVE-2026-8202

What is CVE-2026-8202?

An authenticated user with aggregation permissions can exploit a weakness in the MongoDB Server’s aggregation operators, specifically $trim, $ltrim, and $rtrim, by using a densely populated character mask alongside a large input string. This results in excessive CPU utilization, effectively leading to a denial of service. The issue affects multiple MongoDB Server versions, necessitating prompt updates to mitigate potential service disruptions.

References