EUVD-2026-29894
GHSA-p4m7-wm4c-77hf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
AnalysisAI
Denial of service in MongoDB Server v7.0 through v8.3 allows authenticated users with aggregation permissions to exhaust CPU resources via densely populated character masks in $trim, $ltrim, and $rtrim aggregation operators. An attacker can pin CPU utilization at 100% for extended periods by crafting malicious aggregation queries with large input strings and computationally expensive mask patterns. No public exploit code or active exploitation has been reported at time of analysis.
Technical ContextAI
The vulnerability resides in MongoDB's aggregation pipeline operators $trim, $ltrim, and $rtrim, which are used to remove characters from strings. These operators accept a character mask (chars parameter) that specifies which characters to trim. The underlying implementation appears to use inefficient algorithms when processing densely populated character masks against large input strings, causing excessive CPU iterations without proper bounds checking or algorithmic optimization. This is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the operators fail to constrain computational resource consumption proportional to input size. The vulnerability requires network access (AV:N) and only medium attack complexity (AC:L), but mandates authentication (PR:L) and aggregation permissions, limiting the attack surface to authorized database users.
RemediationAI
Upgrade to patched versions: MongoDB Server 7.0.34 or later, 8.0.23 or later, 8.2.9 or later, or 8.3.2 or later. Consult MongoDB's official release notes at https://jira.mongodb.org/browse/SERVER-120668 for detailed upgrade instructions specific to your version branch. As a temporary mitigation for deployments that cannot immediately patch, restrict aggregation pipeline permissions via role-based access control (RBAC) to only trusted users, or disable the $trim, $ltrim, and $rtrim operators if they are not actively used in production queries. Note that restricting aggregation permissions may impact application functionality if legitimate aggregation pipelines depend on these operators; test thoroughly in staging before deploying production restrictions.
More in Mongodb Server
View allAuthorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthentic
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network acc
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by trigger
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today