CVE-2026-82054

published 2026-09-08

CVE-2026-82054: A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially…

Priority P3 38 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
mongodb	mongodb	—	—
mongodb	mongodb	—	—
mongodb	mongodb	—	—
mongodb	mongodb	>= 7.0.0 < 7.0.41	7.0.41
mongodb	mongodb	>= 8.0.0 < 8.0.30	8.0.30
mongodb	mongodb	8.2.0 – 8.2.12	—
mongodb	mongodb	>= 8.3.0 < 8.3.9	8.3.9
mongodb	mongodb_server	>= 7.0.0 < 7.0.41	7.0.41
mongodb	mongodb_server	>= 8.0.0 < 8.0.30	8.0.30
mongodb	mongodb_server	>= 8.3.0 < 8.3.9	8.3.9

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvd v4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-770