CVE-2026-82056: Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This
Affected Software
Event History
Frequently Asked Questions
Which users could trigger the issue?
An authenticated user with readWrite privileges can trigger it. Exploitation requires specific concurrent text-search and index-management operations involving text index lifecycle activity.
What is the likely operational impact if exploitation succeeds?
The condition can crash the MongoDB server, causing denial of service for all connected clients. The provided severity data indicates no confidentiality or integrity impact.