Resource exhaustion in MongoDB
CVE-2026-82054
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (33.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- MongoDB — versions 9.0.0, 9.1.0
- MongoDB Server
Weakness classification (CWE)
References
- jira.mongodb.org/browse/SERVER-130901 (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-82054?
- CVE-2026-82054 is a medium-severity vulnerability in MongoDB, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-09-08.
- How severe is CVE-2026-82054?
- Medium severity. CVSS v3 base score is 6.5 out of 10.