Is CVE-2026-82055 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82055 being exploited in the wild.

How severe is CVE-2026-82055?

Medium severity, with a CVSS score of 6.5, published 8 September 2026.

Which products and versions are affected?

MongoDB Server 7.0.0–9.1.0 (see notes).

Is there a fix for CVE-2026-82055?

A patch was published on 2026-09-08: Fix versions released: 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82055 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82055?

Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82055: MongoDB null pointer dereference in 2dsphere index

CVE-2026-82055 · Severity: medium · CVSS 6.5 · Published 2026-09-08

MongoDB is a popular database platform used to store and retrieve application data. When malformed geographic data is inserted into a collection with a 2dsphere index, a software defect causes the database server to crash, resulting in service downtime. An authenticated user with write permissions can exploit this to disrupt operations.

Technologies: MongoDB, MongoDB Server. Vendors: MongoDB.

Quick answers

Is CVE-2026-82055 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82055 being exploited in the wild.
How severe is CVE-2026-82055?: Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?: MongoDB Server 7.0.0–9.1.0 (see notes).
Is there a fix for CVE-2026-82055?: A patch was published on 2026-09-08: Fix versions released: 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82055 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82055?: Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a null pointer dereference in MongoDB's GeoJSON parsing logic for 2dsphere index key generation. When GeoJSON parsing fails, the GeometryContainer object fails to clean up its internal state (specifically the _polygon field), but the code then attempts a fallback to legacy point parsing. If the fallback succeeds, downstream geometry processing functions (projectInto, getS2Region) access the stale, uninitialized object state and dereference a null pointer, crashing the mongod process. The vulnerability requires an authenticated user with write access to insert a specially crafted GeoJSON document. The issue affects MongoDB 8.2 through 9.1 with V1–V4 index versions depending on release; versions 8.0 and 7.0 exit early on GeoJSON parsing failure and are not affected. Patches are available in versions 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later.

Affected products

MongoDB MongoDB Server 7.0.0–9.1.0 (see notes)

Timeline

2026-09-08: disclosed: Vulnerability published in NVD
2026-09-08: patched: Fix versions released: 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0

References

https://jira.mongodb.org/browse/SERVER-130202

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.