Which versions of MongoDB Server are affected by CVE-2026-8843?

MongoDB Server versions 7.0, 8.0, and 8.2 contain a high-severity denial-of-service vulnerability that allows authenticated users to crash the database through specially crafted document insertions.. A patch is available.

How to fix or mitigate CVE-2026-8843?

Within 24 hours: inventory all MongoDB Server instances (versions 7.0, 8.0, 8.2) and document user access levels. Within 7 days: apply the vendor-released security patch to all affected instances; alternatively, restrict database access to essential applications only if patching cannot be completed immediately. Within 30 days: verify patch deployment across all environments and review access logs for exploitation attempts.

MongoDB Server CVE-2026-8843

Q: What is the CVSS score of CVE-2026-8843?

CVE-2026-8843 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30777 HIGH

Reachable Assertion (CWE-617)

2026-05-18 mongodb

GHSA-v7q4-vccc-3jxg

Denial Of Service Mongodb Server

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 17:32 vuln.today

Severity Changed

May 18, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

May 18, 2026 - 17:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Patch available

May 18, 2026 - 17:01 EUVD

DescriptionCVE.org

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.

This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

AnalysisAI

Denial of service in MongoDB Server 7.0, 8.0, and 8.2 allows authenticated remote attackers to crash the database by inserting documents that trigger updates to a maliciously created '2dsphere_bucket' or 'queryable_encrypted_range' index on a non-timeseries bucket collection. The flaw stems from a reachable assertion (CWE-617) and is reported by MongoDB itself with a vendor patch available; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability lives in MongoDB Server's index creation logic, where specialty index types intended for specific collection structures ('2dsphere_bucket' for timeseries bucket collections and 'queryable_encrypted_range' for Queryable Encryption) can be created on incompatible non-timeseries bucket collections without proper validation. CWE-617 (Reachable Assertion) indicates the server reaches an internal sanity check that should never fire under valid operation, then aborts the entire mongod process when a subsequent document insert forces the index to update. The CPE entry cpe:2.3:a:mongodb,_inc.:mongodb_server confirms the server daemon itself is the affected component, not drivers or client tooling.

RemediationAI

Vendor-released patch: upgrade MongoDB Server to 7.0.32, 8.0.21, or 8.2.6 (or any later release on the same train), as specified by MongoDB in SERVER-116327 (https://jira.mongodb.org/browse/SERVER-116327). Until the upgrade window, restrict the createIndex privilege to trusted administrative roles only - revoke it from application service accounts that do not legitimately need to create indexes at runtime - which prevents the specific trigger but breaks any application that performs ensureIndex on startup. As a narrower compensating control, audit and block creation of '2dsphere_bucket' and 'queryable_encrypted_range' index types on non-timeseries, non-queryable-encrypted collections via an auditing/proxy layer, accepting that this requires custom tooling since MongoDB has no native index-type allowlist.