EUVD-2026-12639Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
AnalysisAI
Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. The attack requires network access and specific query construction, limiting the practical exploit window.
Technical ContextAI
MongoDB's slot-based execution (SBE) engine is the query execution framework used for aggregation pipelines in modern MongoDB versions. The vulnerability exists in the memory management of in-memory hash tables used during $lookup aggregation operations when these tables exceed memory thresholds and are spilled to disk. The root cause is classified under CWE-415 (Double Free or Use-After-Free), a memory safety issue where memory is accessed after being freed or deallocated. This occurs specifically during the transition from in-memory to disk-based hash table operations in the SBE engine, affecting MongoDB Server product (cpe:2.3:a:mongodb_inc:mongodb_server). The flaw manifests when the hash table spilling mechanism fails to properly manage object lifecycle references, leaving dangling pointers that can be dereferenced in subsequent operations.
RemediationAI
Upgrade MongoDB Server to patched versions: MongoDB Server 7.0.31 or later, MongoDB Server 8.0.20 or later, or MongoDB Server 8.2.6 or later. Consult the vendor security advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-4358 for detailed patch availability and testing guidance. Until upgrades can be performed, implement the following mitigations: restrict write access to MongoDB instances to trusted authentication sources only, disable or restrict aggregation pipeline functionality if operationally feasible, implement network segmentation to limit access to MongoDB instances from application servers only, and monitor database query logs for unusual aggregation patterns involving $lookup operators with large datasets. For Debian-based systems, check for available security updates from your distribution maintainer. Test patches in non-production environments before deployment to validate compatibility with application workloads.
More in Mongodb Server
View allAuthorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthentic
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network acc
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by trigger
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today