What’s Vulnerable › Vulnerabilities
CVE-2026-8199: Post-auth memory exhaustion via bitwise match expressions
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-13 · updated 2026-10-26
- Weakness: CWE-1325
Description
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Affected products
- MongoDB: from 7.0.0 before 7.0.34; from 8.0.0 before 8.0.23; from 8.2.0 before 8.2.9; from 8.3.0 before 8.3.2 — fixed in 7.0.34, 8.0.23, 8.2.9, 8.3.2
How to fix
Upgrade to a fixed version: MongoDB 7.0.34, 8.0.23, 8.2.9, 8.3.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-8199 or the next vulnerability affects your stack