Which versions of Mongodb Server are affected by EUVD-2026-12639?

CVE-2026-4358 presents moderate security risk rated CVSS 6.4. Exploitation could compromise the security of affected deployments.. A patch is available.

Mongodb Server EUVD-2026-12639

Q: What is the CVSS score of EUVD-2026-12639?

EUVD-2026-12639 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-4358 MEDIUM

Double Free (CWE-415)

2026-03-17 mongodb

Information Disclosure Mongodb Server

6.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12639

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 19:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

AnalysisAI

Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H vector indicates network-accessible attack surface but requires relatively high attack complexity and low privileges (authenticated write access). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated database user with write privileges (such as an application service account) constructs a malicious aggregation query using the $lookup operator combined with conditions that force the SBE engine's in-memory hash table to spill to disk. For example, a query joining a large collection with insufficient memory allocation triggers the spill mechanism, exposing the use-after-free vulnerability. …
Remediation	Upgrade MongoDB Server to patched versions: MongoDB Server 7.0.31 or later, MongoDB Server 8.0.20 or later, or MongoDB Server 8.2.6 or later. … Detailed patch versions, workarounds, and compensating controls in full report.