EUVD-2026-56884
GHSA-xv7q-6jr5-mw96
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects mandatory authenticated read/write access; VA:H captures reliable server crash; C:L reflects probabilistic heap disclosure dependent on layout.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.
AnalysisAI
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Technical ContextAI
MongoDB Server is a widely used NoSQL document database; time-series collections are a specialized storage format introduced to optimize ingestion and querying of sequentially timestamped data. The query execution engine fails to enforce correct object lifetime when evaluating certain queries against these collections - an internal reference is held and later dereferenced after the backing heap allocation has been freed, matching the CWE-416 use-after-free root cause class. This is a memory corruption class bug: depending on heap layout and timing, the freed region may have been reallocated with attacker-observable data (information disclosure) or may trigger an illegal memory access causing a crash (denial of service). The CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:L/UI:N confirms the flaw is reachable over the network with no special attack prerequisites beyond authenticated low-privilege access. The affected CPE is cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*, with wildcard version fields indicating NVD has not yet bounded the affected release range.
RemediationAI
No exact patched version has been confirmed from the available data - the sole reference is MongoDB Jira ticket SERVER-130247 (https://jira.mongodb.org/browse/SERVER-130247), and a vendor-released patch version has not been independently identified at time of analysis. Defenders should monitor that Jira issue and MongoDB's security advisories page for a fix release and upgrade promptly once available. As a compensating control, restrict read and write access to time-series collections to only the minimum set of service accounts that genuinely require it, reducing the pool of principals that can trigger the vulnerable query path; note this does not eliminate the risk for legitimate accounts. For deployments that do not use time-series collections, disabling or avoiding creation of time-series collections eliminates exposure entirely with no functional trade-off for those workloads. Network-level restrictions on MongoDB's listening port (default 27017/TCP) to trusted application tiers limit lateral exploitation by compromised internal accounts but do not protect against a malicious or compromised application-layer principal.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today