Which versions of MongoDB Server are affected by EUVD-2026-56917?

MongoDB Server deployments are vulnerable to denial-of-service and memory disclosure attacks through malformed geospatial documents (CVE-2026-18694).. A patch is available.

How to fix or mitigate EUVD-2026-56917?

Within 24 hours, audit all MongoDB deployments to identify which authenticated accounts hold write privileges on geospatial collections. Within 7 days, implement database-level access restrictions to limit writes on geospatial collections to trusted service accounts only, disable geospatial indexing on non-critical collections, and enable MongoDB audit logging. Within 30 days, deploy application-level validation of geometry document structure before storage, establish monitoring for out-of-bounds read errors in MongoDB logs, and maintain contact with MongoDB security for patch timeline updates.

MongoDB Server EUVD-2026-56917

Q: What is the CVSS score of EUVD-2026-56917?

EUVD-2026-56917 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-18694 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 mongodb

GHSA-5qh4-4xrx-49h2

Buffer Overflow Denial Of Service Information Disclosure MongoDB Mongodb Server

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable service (AV:N), low-complexity exploitation (AC:L), requires authenticated write access (PR:L), no scope change, high availability loss from server crash and low confidentiality from bounded memory disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:16 vuln.today

CVE Published

Aug 11, 2026 - 18:42 cve.org

HIGH 7.1

DescriptionCVE.org

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.

AnalysisAI

Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

CWE-125 (Out-of-bounds Read) describes the root cause: the MongoDB geospatial subsystem reads beyond the allocated buffer when processing geometry objects that were stored without adequate structural validation. MongoDB's geospatial features accept GeoJSON and legacy coordinate-pair formats for spatial indexing and querying; the vulnerability lies in a disconnect between storage-time and query-time validation, where certain malformed geometry payloads pass write-path checks but trigger unsafe memory access during query evaluation. The out-of-bounds read can manifest as a segmentation fault (causing the mongod process to crash) or as reading adjacent heap or stack memory (enabling limited information disclosure). The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* indicates the flaw is tracked across all MongoDB Server versions, with no bounded version range yet published by the vendor.

RemediationAI

No specific patched MongoDB Server version has been confirmed in the available data - the vendor advisory reference is the MongoDB Jira issue SERVER-130188 (https://jira.mongodb.org/browse/SERVER-130188), which should be monitored for patch release announcements. Operators should subscribe to MongoDB security advisories at mongodb.com/security and apply the fix release as soon as it is published. As a compensating control prior to patching, restrict write access to geospatial collections to the minimum required accounts, and audit existing role grants to remove unnecessary write privileges from service accounts and application users. If geospatial indexing is not required by the application, disabling geospatial indexes and rejecting GeoJSON document writes at the application layer removes the attack surface entirely, though this may impact application functionality. Network-level controls that restrict mongod access to trusted application tiers reduce exposure but do not eliminate the risk from legitimate authenticated users.