Executive brief
MongoDB Server is a widely-used database system that stores data in collections and supports specialized "timeseries" buckets for efficient time-series data management. An authenticated user with database write permissions can trigger a use-after-free memory error in the timeseries bucket lifecycle, potentially causing the database server to crash or execute unintended code. This impacts availability and could lead to data loss or unauthorized operations on affected deployments.
Technical details
This vulnerability is a use-after-free (CWE-416) in MongoDB Server's timeseries bucket lifecycle handling. The root cause is a collision in bucket OIDs (object identifiers) during bucket allocation that leaves a dangling pointer to a bucket undo transition. An authenticated attacker with write privileges can trigger this condition, causing internal references to be used after the underlying memory has been freed. Exploitation requires authentication and write access but no additional user interaction; subsequent database operations can then result in a server crash or potentially arbitrary code execution. The vulnerability is addressed in MongoDB versions 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server Before 8.2.13, 8.3.x before 8.3.8, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Fixes released in versions 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0