EUVD-2026-29892
GHSA-r8cx-9wfm-r3m7
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.
This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
AnalysisAI
Use-after-free in MongoDB Server's Field-Level Encryption query analysis component allows authenticated remote attackers with control over FLE query structure to cause information disclosure and denial of service. The vulnerability affects mongocryptd and crypt_shared in versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. No public exploit code identified at time of analysis.
Technical ContextAI
MongoDB's Field-Level Encryption (FLE) provides client-side encryption of sensitive data before transmission to the database. The mongocryptd daemon and crypt_shared library handle query analysis and encryption/decryption operations on the client side. The vulnerability is a use-after-free defect (CWE-416) in the FLE query analysis component, where memory is referenced after being freed. This typically occurs when pointer management fails to track object lifecycle correctly, allowing subsequent operations to access dangling references. An authenticated attacker controlling the structure of FLE-related queries can craft payloads that trigger improper memory reuse, potentially leading to information disclosure through memory corruption or service interruption.
RemediationAI
Upgrade MongoDB Server to patched versions: 7.0.34 or later, 8.0.23 or later, 8.2.9 or later, or 8.3.2 or later. Organizations unable to patch immediately should implement access controls restricting authenticated users who can submit FLE queries to trusted applications only, reducing the attack surface by limiting who can control query structure. Disable Field-Level Encryption on client instances if the feature is not required for the application's use case-this eliminates exposure entirely but may impact data protection strategy. Monitor applications for unusual memory-related errors or crashes correlated with FLE query patterns. These compensating controls trade functionality (encryption availability or user flexibility) against reduced risk exposure until patching is feasible.
More in Mongodb Server
View allAuthorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthentic
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network acc
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by trigger
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today