CVE-2026-8843: Calling createIndex with certain index types can crash mongod
Creating a "2dspherebucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryableencryptedrange" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 7.0.32 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.0.21 - Upgrade
Upgrade
MongoDB Serverto a version that resolves this vulnerability.Fixed in 8.2.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8843?
CVE-2026-8843 is classified as a critical severity vulnerability due to its potential to crash the MongoDB server.
How do I fix CVE-2026-8843?
To mitigate CVE-2026-8843, avoid creating "2dsphere_bucket" indexes on non-timeseries bucket collections and ensure your MongoDB version is updated to the latest patch.
What are the affected versions of MongoDB for CVE-2026-8843?
CVE-2026-8843 affects MongoDB version 7.0.0 to 7.0.32, 8.0.0 to 8.0.21, and 8.2.0 to 8.2.6.
What happens if I trigger the vulnerability in CVE-2026-8843?
Triggering the vulnerability in CVE-2026-8843 can lead to the MongoDB server crashing during an index update.
Is there a workaround for CVE-2026-8843?
As a workaround for CVE-2026-8843, refrain from using the problematic index types until a fix is applied.