TI-2026-56620 Aliases CVE-2026-82056 GHSA-63w5-8wj5-r44q

Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service

LOW 27CWE-416Published 2026-09-08 · Updated 2026-09-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00332 26th percentileScored 2026-11-07

Fix Fixed MongoDB Server (MongoDB): 8.3.9, 8.0.30, 7.0.41

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MongoDB	MongoDB Server	8.3.0 to before 8.3.9; 8.0.0 to before 8.0.30; 7.0.0 to before 7.0.41	8.3.9, 8.0.30, 7.0.41	Patch available	CNA

MongoDB Server VendorMongoDB Affected 8.3.0 to before 8.3.9; 8.0.0 to before 8.0.30; 7.0.0 to before 7.0.41 Fixed in 8.3.9, 8.0.30, 7.0.41 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mongodb:mongodb:::::-:::*	7.0.0 to before 7.0.41; 8.0.0 to before 8.0.30; 8.3.0 to before 8.3.9	Vulnerable	MongoDB

cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:* Versions 7.0.0 to before 7.0.41; 8.0.0 to before 8.0.30; 8.3.0 to before 8.3.9 Vulnerable ·MongoDB

Remediation

Fix · CNA MongoDB Server (MongoDB) Fixed in 8.3.9, 8.0.30, 7.0.41

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-08
MongoDB Server 7.0.41, 8.0.30, 8.3.9
16 records Highest priority Priority MEDIUM 3 MEDIUM, 13 LOW
Other records, highest priority first
- TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of ServicePriority MEDIUM 44
- TI-2026-56628 Reachable assertion in MongoDB ServerPriority MEDIUM 44
- TI-2026-56631 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause…Priority MEDIUM 42
Show all 16 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82056
2026-10-03 Alias added: GHSA-63w5-8wj5-r44q

References

Advisory 1

https://jira.mongodb.org/browse/SERVER-130306

TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7

See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences