Executive brief
MongoDB Server contains a use-after-free vulnerability in its cursor management component that allows authenticated users to crash the database server. An attacker with valid database credentials can trigger a denial of service by exploiting specific timing conditions during cursor operations, causing the server process to terminate and making the database unavailable to legitimate users.
Technical details
This is a use-after-free memory safety vulnerability in MongoDB Server's cursor management component. Under specific timing conditions during cursor operations, a stale pointer to a previously freed resource may be retained and subsequently dereferenced during cursor cleanup, triggering a segmentation fault or heap corruption. The vulnerability requires authentication to the database and depends on precise timing of concurrent cursor operations. An authenticated attacker can reliably cause a server process crash, resulting in denial of service. The issue has been fixed in versions 7.0.41, 8.0.30, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later.
Affected products
- MongoDB Server before 7.0.41, 8.0.x before 8.0.30, 8.1.x before 8.3.9, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in versions 7.0.41, 8.0.30, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later