Which versions of MongoDB Server are affected by CVE-2026-6914?

MongoDB Server versions 7.0 through 8.2 contain a vulnerability allowing authenticated database users to trigger denial-of-service crashes through specially formatted BSON requests.. A patch is available.

How to fix or mitigate CVE-2026-6914?

Within 24 hours, audit all MongoDB deployments to identify affected versions (7.0 before 7.0.32, 8.0 before 8.0.21, or 8.1/8.2 up to 8.2.7) and prioritize production systems. Within 7 days, upgrade affected deployments to MongoDB v7.0.32, v8.0.21, or v8.2.7 respectively, testing in non-production environments first to validate application compatibility. Within 30 days, confirm all MongoDB servers are running patched versions, implement database-level access controls restricting authenticated connections to essential application service accounts, and enable audit logging to detect unauthorized authentication attempts.

MongoDB Server CVE-2026-6914

Q: What is the CVSS score of CVE-2026-6914?

CVE-2026-6914 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26262 HIGH

Integer Underflow (CWE-191)

2026-04-29 mongodb

Information Disclosure Integer Overflow MongoDB Mongodb Server

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and low-complexity, but requires an authenticated low-privilege session (PR:L); impact is availability-only (A:H, C:N/I:N) with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:39 vuln.today

Patch released

Apr 30, 2026 - 15:13 nvd

Patch available

Apr 29, 2026 - 19:02 EUVD

Severity Changed

Apr 29, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Apr 29, 2026 - 17:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 17:15 euvd

EUVD-2026-26262

CVE Published

Apr 29, 2026 - 16:47 nvd

HIGH 7.1

DescriptionCVE.org

Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32

AnalysisAI

Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.

Technical ContextAI

MongoDB stores and transmits data as BSON (Binary JSON), a length-prefixed binary serialization format. Certain operations compute an MD5 checksum over BSON payloads (for example filemd5 / GridFS chunk verification and internal integrity checks). CWE-191 (Integer Underflow/wraparound) indicates that a length or size field within a malformed BSON object is processed without correct bounds handling, so an arithmetic wrap produces an invalid buffer length or read size during MD5 computation, driving the server into a crash or unrecoverable state. The affected component is the mongod server process itself (cpe:2.3:a:mongodb:mongodb_server:*), not a client driver, so the fault takes down the database node rather than a single connection.

RemediationAI

Vendor-released patch: upgrade MongoDB Server to 7.0.32 (7.0.x), 8.0.21 (8.0.x), or 8.2.7 (8.2.x); the 8.1 series has no fixed release, so 8.1 deployments should migrate to 8.2.7 or later. Track fixes via the MongoDB ticket https://jira.mongodb.org/browse/SERVER-119981 and confirm exact build in the corresponding release notes before deploying. Because exploitation requires an authenticated session (PR:L), the primary compensating control until patching is to tighten authentication and authorization - ensure the server is not exposed on untrusted networks, enforce least-privilege roles, and restrict which accounts can invoke checksum/GridFS (filemd5) operations; the trade-off is that limiting filemd5/GridFS usage may break applications relying on server-side chunk verification. Additionally bind mongod to trusted interfaces and place it behind network ACLs/firewall rules so only known application hosts can connect, reducing the population of clients able to send malformed BSON.