Denial of Service Vulnerability in MongoDB Server
CVE-2026-82064

8.7HIGH

Key Information:

Vendor

Mongodb
Status
Mongodb Server
Vendor
CVE Published:
8 September 2026

What is CVE-2026-82064?

A security issue in MongoDB Server allows unauthenticated network users to trigger a denial of service condition on specific types of replica set members. This vulnerability arises from an assertion within the read concern processing logic that can be accessed without prior authentication. The assertion’s assumptions regarding the internal state of the database do not hold for all replica set configurations, leading to unexpected behavior and potential server termination.

Affected Version(s)

MongoDB Server 8.3.0 < 8.3.9

MongoDB Server 8.0.0 < 8.0.30

MongoDB Server 7.0.0 < 7.0.41

References

https://jira.mongodb.org/browse/SERVER-130759

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.