CVE-2026-82054

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Allocation of Resources Without Limits or Throttling pada mongodb. Skor CVSS 3.1 6.5 (Medium) menurut mongodb.com.

Deskripsi (NVD)

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Rincian

Terbit di NVD

8 September 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/SERVER-130901 advisory vendor · issue tracking