Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators_CVE-2026-8202

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Basic Information

ID CVE-2026-8202

Source mongodb

Published May 13, 2026 at 00:19

Modified May 13, 2026 at 01:38

Affected Product

Vendor MongoDB, Inc.

Product MongoDB Server

Version 7.0

Affected Versions MongoDB, Inc. MongoDB Server 7.0
MongoDB, Inc. MongoDB Server 8.0
MongoDB, Inc. MongoDB Server 8.2
MongoDB, Inc. MongoDB Server 8.3

CWE Classification

CWE-770

References

jira.mongodb.org /browse/SERVER-120668

{
    "lastseen": "",
    "description": "Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.",
    "published": "2026-05-13T00:19:41.441Z",
    "modified": "2026-05-13T01:38:09.751Z",
    "type": "cve",
    "title": "Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators",
    "source": "mongodb",
    "references": "https://jira.mongodb.org/browse/SERVER-120668",
    "id": "CVE-2026-8202",
    "bulletinFamily": "",
    "cwe": [
        "CWE-770"
    ],
    "cvelist": null,
    "sourceData": "MongoDB, Inc. MongoDB Server 7.0\nMongoDB, Inc. MongoDB Server 8.0\nMongoDB, Inc. MongoDB Server 8.2\nMongoDB, Inc. MongoDB Server 8.3",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "MongoDB Server",
    "version": "7.0",
    "vendor": "MongoDB, Inc.",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}