Executive brief
MongoDB server contains a race condition in text index query handling that can crash the database when multiple index operations occur simultaneously. An authenticated user with basic write permissions can trigger this crash through concurrent search and index management operations, causing service disruption for all connected users and applications relying on the database.
Technical details
A heap use-after-free vulnerability exists in MongoDB's TextMatchExpression component due to a race condition during concurrent text index lifecycle operations. When an authenticated user with readWrite privileges performs specific combinations of text-search queries and index management operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed. This causes a server crash resulting in denial of service. The vulnerability requires authentication and specific timing of concurrent operations to exploit. Patches are available in MongoDB versions 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, and 9.1.0-rc0 or later.
Affected products
- MongoDB MongoDB Server before 8.0.30, before 8.2.13, before 8.3.9, before 9.0.0-rc2, before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed: CVE-2026-82056 published
- 2026-09-08: patched: Fix released in versions 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0 and later