EUVD-2026-29890
GHSA-ch76-jrmh-qm2h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
AnalysisAI
Authenticated attackers can exhaust MongoDB Server memory using malicious bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear), leading to out-of-memory denial of service. Affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. Vendor-released patches are available across all affected major versions. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability in the wild, and no public exploit code has been identified at time of analysis.
Technical ContextAI
This vulnerability resides in MongoDB Server's query processing engine, specifically the Abstract Syntax Tree (AST) parsing logic for bitwise match operators used in query expressions. The affected operators ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear) enable bitwise comparisons in MongoDB queries but contain a flaw (CWE-1325: Improperly Controlled Sequential Memory Allocation) where crafted expressions trigger unbounded memory allocation during AST construction or evaluation. MongoDB's query execution pipeline parses these operators into an internal AST representation, and the vulnerability allows authenticated users to construct queries that cause the parser to allocate excessive heap memory without proper bounds checking. This memory exhaustion is not released until the query completes or the server process terminates, creating sustained memory pressure. The vulnerability affects four concurrent major version branches (7.0, 8.0, 8.2, 8.3), suggesting the vulnerable code path exists in a shared query processing component across MongoDB's current architecture.
RemediationAI
Upgrade to patched MongoDB Server versions: 7.0.34 or later for 7.0.x deployments, 8.0.23 or later for 8.0.x deployments, 8.2.9 or later for 8.2.x deployments, or 8.3.2 or later for 8.3.x deployments. Vendor patches available from MongoDB official channels and detailed in Jira issue SERVER-122449 at https://jira.mongodb.org/browse/SERVER-122449. If immediate patching is not feasible, implement compensating controls: restrict database authentication to only trusted users and applications with business justification (reduces attack surface to PR:L requirement); configure MongoDB memory limits using systemd MemoryMax or container resource limits to contain OOM impact (prevents complete system failure but may cause database restarts-test thoroughly as this affects legitimate workload); enable MongoDB query profiling and establish baseline memory usage patterns to detect anomalous query behavior (set slowms threshold and monitor for queries with excessive memory allocation); implement application-layer query validation to reject or sanitize queries containing $bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear operators if not required by legitimate use cases (requires application code changes and may break functionality). Note that compensating controls only reduce likelihood or impact-patching is the definitive remediation.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level pr
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today