EUVD-2026-12639Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
AnalysisAI
Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. The attack requires network access and specific query construction, limiting the practical exploit window.
Technical ContextAI
MongoDB's slot-based execution (SBE) engine is the query execution framework used for aggregation pipelines in modern MongoDB versions. The vulnerability exists in the memory management of in-memory hash tables used during $lookup aggregation operations when these tables exceed memory thresholds and are spilled to disk. The root cause is classified under CWE-415 (Double Free or Use-After-Free), a memory safety issue where memory is accessed after being freed or deallocated. This occurs specifically during the transition from in-memory to disk-based hash table operations in the SBE engine, affecting MongoDB Server product (cpe:2.3:a:mongodb_inc:mongodb_server). The flaw manifests when the hash table spilling mechanism fails to properly manage object lifecycle references, leaving dangling pointers that can be dereferenced in subsequent operations.
RemediationAI
Upgrade MongoDB Server to patched versions: MongoDB Server 7.0.31 or later, MongoDB Server 8.0.20 or later, or MongoDB Server 8.2.6 or later. Consult the vendor security advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-4358 for detailed patch availability and testing guidance. Until upgrades can be performed, implement the following mitigations: restrict write access to MongoDB instances to trusted authentication sources only, disable or restrict aggregation pipeline functionality if operationally feasible, implement network segmentation to limit access to MongoDB instances from application servers only, and monitor database query logs for unusual aggregation patterns involving $lookup operators with large datasets. For Debian-based systems, check for available security updates from your distribution maintainer. Test patches in non-production environments before deployment to validate compatibility with application workloads.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today