CVE-2026-82076: Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with ordinary database-level read/write privileges can exploit it. No elevated administrative privilege or user interaction is required.
What does an attacker need to do to trigger the denial of service?
The attacker must submit a specially crafted query that triggers the integer overflow during query planning. The overflow bypasses an internal resource limit and causes unbounded memory consumption until the server process terminates.
What is the operational impact if exploitation succeeds?
The affected MongoDB Server process terminates from memory exhaustion. Because the impact is at the node level, all databases served by that node may be unavailable.