Vulnerability · Published Sep 8, 2026 · Assigned by mongodb
CVE-2026-82076Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
Medium 6.5
In plain English
A medium-severity integer overflow in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 – before 8.3.98.0.0 – before 8.0.307.0.0 – before 7.0.41 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H