Use-After-Free Vulnerability in MongoDB Server Affects Cursor Management
CVE-2026-82063

6MEDIUM

Key Information:

Vendor

Mongodb
Status
Mongodb Server
Vendor
CVE Published:
8 September 2026

What is CVE-2026-82063?

A use-after-free vulnerability exists in the cursor management component of MongoDB Server, enabling an authenticated user to initiate a denial of service attack. This issue arises under specific timing conditions during cursor operations, where a stale pointer to a previously freed resource is retained. When this pointer is dereferenced during the cleanup of cursors, it can lead to a crash of the server process, thereby disrupting service availability.

Affected Version(s)

MongoDB Server 8.3.0 < 8.3.9

MongoDB Server 8.0.0 < 8.0.30

MongoDB Server 7.0.0 < 7.0.41

References

https://jira.mongodb.org/browse/SERVER-131870

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.