CVE-2026-82054Medium· 6.5▾ SunlitA security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.
mongodb >= 7.0.0, < 7.0.41mongodb >= 8.0.0, < 8.0.30mongodb >= 8.2.0, <= 8.2.12mongodb >= 8.3.0, < 8.3.9mongodb = 9.0.0mongodb = 9.1.0Upgrade past the affected range:
mongodb 8.3.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82075High· 7.5An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process
CVE-2026-114644Medium· 5.9Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
CVE-2026-96299Medium· 6.5A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline
CVE-2026-87110Medium· 5.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting
CVE-2026-89099High· 7.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption
CVE-2026-84967Medium· 4.3A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal