CVE-2026-82054 PUBLISHED

Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service

Assigner: mongodb
Reserved: 27.08.2026 Published: 08.09.2026 Updated: 08.09.2026

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor MongoDB
Product MongoDB Server
Versions Default: unaffected
  • affected from 8.3.0 to 8.3.9 (excl.)
  • affected from 8.0.0 to 8.0.30 (excl.)
  • affected from 7.0.0 to 7.0.41 (excl.)

References

Problem Types

  • CWE-770: Allocation of Resources Without Limits or Throttling CWE