CVE-2026-8199

EUVD-2026-29890
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Affected Products (NVD)
VendorProductVersion
mongodbmongodb
7.0.0 ≤
𝑥
< 7.0.34
mongodbmongodb
8.0.0 ≤
𝑥
< 8.0.23
mongodbmongodb
8.2.0 ≤
𝑥
< 8.2.9
mongodbmongodb
8.3.0 ≤
𝑥
< 8.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://jira.mongodb.org/browse/SERVER-122449