CVE-2026-8199: Post-auth memory exhaustion via bitwise match expressions
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.34 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.23 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.2.9 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8199?
CVE-2026-8199 has a high severity rating due to its potential to exhaust memory and lead to Denial of Service.
How do I fix CVE-2026-8199?
To mitigate CVE-2026-8199, upgrade MongoDB Server to a version beyond 7.0.34, 8.0.23, 8.2.9, or 8.3.2.
What impact does CVE-2026-8199 have on MongoDB Server?
CVE-2026-8199 can lead to increased memory pressure, potentially causing the server to run out of memory and become unavailable.
Who is affected by CVE-2026-8199?
Authenticated users of MongoDB Server versions within the specified vulnerable ranges are affected by CVE-2026-8199.
What are the specific expressions that trigger CVE-2026-8199?
CVE-2026-8199 is triggered by using bitwise match expressions such as $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.