CVE-2026-8202: Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.34 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.23 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.2.9 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8202?
CVE-2026-8202 is classified as a medium severity vulnerability that allows for Denial of Service via excessive CPU utilization.
How do I fix CVE-2026-8202?
To mitigate CVE-2026-8202, upgrade your MongoDB Server to a version higher than 7.0.34, 8.0.23, 8.2.9, or 8.3.2.
What is the impact of CVE-2026-8202 if exploited?
Exploiting CVE-2026-8202 can result in sustained high CPU utilization, leading to Denial of Service for legitimate users.
Who is affected by CVE-2026-8202?
CVE-2026-8202 affects authenticated users with aggregation permissions on MongoDB Server versions prior to 7.0.34, 8.0.23, 8.2.9, and 8.3.2.
What aggregation operators are involved in CVE-2026-8202?
CVE-2026-8202 involves the MongoDB aggregation operators $trim, $ltrim, and $rtrim.