Post-auth memory exhaustion via bitwise match expressions_CVE-2026-8199

7.1 / 10

HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Description

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Basic Information

ID CVE-2026-8199

Source mongodb

Published May 13, 2026 at 00:05

Affected Product

Vendor MongoDB, Inc.

Product MongoDB Server

Version 7.0

Affected Versions MongoDB, Inc. MongoDB Server 7.0
MongoDB, Inc. MongoDB Server 8.0
MongoDB, Inc. MongoDB Server 8.2
MongoDB, Inc. MongoDB Server 8.3

CWE Classification

CWE-1325

References

jira.mongodb.org /browse/SERVER-122449

{
    "lastseen": "",
    "description": "An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.",
    "published": "2026-05-13T00:05:22.748Z",
    "modified": "2026-05-13T00:05:22.748Z",
    "type": "cve",
    "title": "Post-auth memory exhaustion via bitwise match expressions",
    "source": "mongodb",
    "references": "https://jira.mongodb.org/browse/SERVER-122449",
    "id": "CVE-2026-8199",
    "bulletinFamily": "",
    "cwe": [
        "CWE-1325"
    ],
    "cvelist": null,
    "sourceData": "MongoDB, Inc. MongoDB Server 7.0\nMongoDB, Inc. MongoDB Server 8.0\nMongoDB, Inc. MongoDB Server 8.2\nMongoDB, Inc. MongoDB Server 8.3",
    "sourceHref": "",
    "cvss": {
        "score": 7.1,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "MongoDB Server",
    "version": "7.0",
    "vendor": "MongoDB, Inc.",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}