EUVD-2026-56913
GHSA-q985-47v7-9c79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated write access (PR:L) and concurrent timing to win the race condition (AC:H); impact is solely server availability via crash.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.
AnalysisAI
Use-after-free in MongoDB Server's geospatial validation subsystem allows an authenticated user with write privileges to crash the database server through concurrent operations against a collection using a specific validator type. Affected branches are MongoDB 7.0 (prior to 7.0.40), 8.0 (prior to 8.0.29), and 8.3.x (prior to 8.3.8), per EUVD advisory EUVD-2026-56913. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid MongoDB user account with at minimum write privileges to the target collection - unauthenticated network access is insufficient; (2) the target collection must be configured with a specific type of geospatial validator - collections without this validator type are not affected; (3) concurrent write operations must be submitted simultaneously to win the race condition, meaning automated or scripted attack tooling is necessary and single sequential writes will not trigger the flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.0 reflects a network-reachable availability-only impact constrained by authentication and a timing prerequisite (AT:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated database user with write privileges - such as a compromised application service account - submits a high volume of concurrent write operations against a MongoDB collection that has a geospatial validator configured. The concurrent operations trigger a race condition in the server's geospatial validation logic, causing a freed memory reference to be dereferenced, which crashes the mongod process and denies service to all connected clients. … |
| Remediation | Upgrade MongoDB Server to 7.0.40, 8.0.29, or 8.3.8 depending on the deployed release branch; these are the confirmed fix versions per vendor advisory EUVD-2026-56913. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today