Mongodb Server
Approved changes feed: RSS · Atom
cpe:2.3:a:mongodb,_inc.:mongodb_server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Mongodb, Inc. (8b5c87c2-3d1f-5f22-86c2-8e3d53f5a3ce) |
|---|---|
| Product | Mongodb Server (5986ca0c-d88c-5bda-a2ba-a585d273fdf1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-8843 |
vulnerable | 2026-06-08 08:08:58.670667 |
Calling createIndex with certain index types can crash mongod
MEDIUM (6.5)
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
Published: 2026-05-18T15:40:06.265Z
Updated: 2026-05-19T12:53:50.130Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8336 |
vulnerable | 2026-06-08 08:08:58.293670 |
Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands
HIGH (7.5)
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.
This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Published: 2026-05-13T00:16:16.568Z
Updated: 2026-05-15T16:16:00.092Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8202 |
vulnerable | 2026-06-08 08:08:58.196747 |
Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
MEDIUM (4.3)
Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Published: 2026-05-13T00:19:41.441Z
Updated: 2026-05-13T01:38:09.751Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8201 |
vulnerable | 2026-06-08 08:08:58.196225 |
Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
MEDIUM (6.4)
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.
This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Published: 2026-05-13T00:12:35.299Z
Updated: 2026-05-13T14:34:27.091Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8200 |
vulnerable | 2026-06-08 08:08:58.195739 |
Schema validation log messages may not redact user data
LOW (2.7)
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Published: 2026-05-13T00:08:29.761Z
Updated: 2026-05-13T14:31:27.118Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8199 |
vulnerable | 2026-06-08 08:08:58.195228 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8053 |
vulnerable | 2026-06-08 08:08:58.033463 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.