What’s Vulnerable › Vulnerabilities
CVE-2026-4358: Memory safety issues in slot-based execution hash table spill
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-17 · updated 2026-06-17
- Weakness: CWE-415
Description
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
Affected products
- MongoDB: from 7.0.0 before 7.0.31; from 8.0.0 before 8.0.20; from 8.2.0 before 8.2.6 — fixed in 7.0.31, 8.0.20, 8.2.6
How to fix
Upgrade to a fixed version: MongoDB 7.0.31, 8.0.20, 8.2.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-4358 or the next vulnerability affects your stack