CVE-2026-82075High· 7.5▾ TwilightAn uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.
mongodb >= 7.0.0, < 7.0.41mongodb >= 8.0.0, < 8.0.30mongodb >= 8.3.0, < 8.3.9Upgrade past the affected range:
mongodb 8.3.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82054Medium· 6.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing
CVE-2026-114644Medium· 5.9Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
CVE-2026-96299Medium· 6.5A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline
CVE-2026-87110Medium· 5.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting
CVE-2026-89099High· 7.5A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption
CVE-2026-84967Medium· 4.3A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal