What is CVE-2026-8202?

CVE-2026-8202 is a medium-severity vulnerability in MongoDB, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 4.3/10. Published 2026-05-13.

How severe is CVE-2026-8202?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Resource exhaustion in MongoDB

CVE-2026-8202

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Published 2026-05-13 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.005 (36.7th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002

Affected products

MongoDB
MongoDB, Inc. MongoDB Server — versions 7.0, 8.0, 8.2

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

jira.mongodb.org/browse/SERVER-120668 (issue-tracking, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2026-8202?: CVE-2026-8202 is a medium-severity vulnerability in MongoDB, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 4.3/10. Published 2026-05-13.
How severe is CVE-2026-8202?: Medium severity. CVSS v3 base score is 4.3 out of 10.