CVE-2026-8053: FlatBSON Duplicate Field Index Drift

Q: What is the severity of CVE-2026-8053?

CVE-2026-8053 is classified as a high severity vulnerability due to its potential for an out-of-bounds memory write.

Q: How do I fix CVE-2026-8053?

To mitigate CVE-2026-8053, upgrade your MongoDB Server to a version later than 5.0.33, 6.0.28, 7.0.34, 8.0.23, 8.2.9, or 8.3.2.

Q: Who is affected by CVE-2026-8053?

CVE-2026-8053 affects authenticated users with write privileges in specific MongoDB Server versions.

Q: What are the consequences of CVE-2026-8053?

Exploitation of CVE-2026-8053 could lead to application crashes or unexpected behavior in MongoDB Server.

Q: What types of applications might be vulnerable due to CVE-2026-8053?

Applications using affected versions of MongoDB for time-series data collection are vulnerable to CVE-2026-8053.

Published May 12, 2026

Updated

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.

This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Affected Software

7 affected components

MongoDB MongoDB Server<5.0.33, <6.0.28, <7.0.34, <8.0.23, <8.2.9, <8.3.2

MongoDB MongoDB>=5.0.0<5.0.33

MongoDB MongoDB>=6.0.0<6.0.28

MongoDB MongoDB>=7.0.0<7.0.34

MongoDB MongoDB>=8.0.0<8.0.23

MongoDB MongoDB>=8.2.0<8.2.9

MongoDB MongoDB>=8.3.0<8.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MongoDB Server to a version that resolves this vulnerability.
Fixed in 5.0.33
Upgrade
Upgrade MongoDB Server to a version that resolves this vulnerability.
Fixed in 6.0.28
Upgrade
Upgrade MongoDB Server to a version that resolves this vulnerability.
Fixed in 7.0.34
Upgrade
Upgrade MongoDB Server to a version that resolves this vulnerability.
Fixed in 8.0.23
Upgrade
Upgrade MongoDB Server to a version that resolves this vulnerability.
Fixed in 8.2.9
Upgrade
Upgrade MongoDB Server to a version that resolves this vulnerability.
Fixed in 8.3.2

Event History

May 12, 2026

CVE Published

via MITRE·11:59 PM

Data Sourced

via MITRE·11:59 PM

DescriptionSeverityWeakness

May 13, 2026

Data Sourced

via NVD·04:17 AM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 31, 58347

Event

via FIRST·08:49 AM

Frequently Asked Questions

What is the severity of CVE-2026-8053?

CVE-2026-8053 is classified as a high severity vulnerability due to its potential for an out-of-bounds memory write.

How do I fix CVE-2026-8053?