CVE-2026-82076 — Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server

CVE-2026-82076

Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server PUBLISHED

Description (CNA)

An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.3.0 before 8.3.9; affected 8.0.0 before 8.0.30; affected 7.0.0 before 7.0.41

CWE

CWE-190

References

https://jira.mongodb.org/browse/SERVER-128253

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.