Memory Amplification Vulnerability in MongoDB Server's JSON Pointer Parser

CVE-2026-82054

What is CVE-2026-82054?

A security issue has been identified in the MongoDB server due to its JSON Pointer parser utilized during the processing of $jsonSchema query filters. When a find command incorporates a carefully constructed $jsonSchema filter, the parser fails to exercise sufficient constraints on iteration counts and total allocation sizes. This oversight can lead to severe memory amplification, particularly under heavy concurrent request loads. Consequently, the cumulative memory demands might surpass available heap memory, leading the server’s out-of-memory handler to terminate the mongod process, which results in service denial for all connected clients.

References