# CVE-2026-82075: MongoDB mongos uncontrolled resource consumption

Source: https://junglewise.ai/threats/cve-2026-82075-mongodb-mongos-uncontrolled-resource-consumption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82075 · Severity: high · CVSS 7.5 · Published 2026-09-08

MongoDB's sharded-cluster router (mongos) contains a vulnerability that allows unauthenticated clients to cause excessive CPU usage through specially crafted connection-monitoring parameters. An attacker with network access can degrade or deny service to legitimate database clients without needing credentials or special privileges.

Technologies: [MongoDB](https://junglewise.ai/threats/technologies/mongodb). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-82075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82075 being exploited in the wild.

**How severe is CVE-2026-82075?** High severity, with a CVSS score of 7.5, published 8 September 2026.

**Which products and versions are affected?** MongoDB before 7.0.41, 8.0.x before 8.0.30, 8.1.x before 8.2.13, 8.2.x before 8.2.13, 8.3.x before 8.3.9, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0.

**Is there a fix for CVE-2026-82075?** A patch was published on 2026-09-08: Patches released in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82075 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-82075?** Check whether you run MongoDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an uncontrolled resource consumption vulnerability (denial of service) in the mongos router's request-handling path. The vulnerable component does not apply rate limiting or enforce a minimum timeout on pre-authentication streaming "hello" commands, allowing an unauthenticated client to manipulate connection-monitoring parameters to force CPU-intensive operations. No authentication is required; an attacker only needs network access to a mongos port. The attack impacts availability only; data confidentiality and integrity are not affected. Patches are available in MongoDB versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later.

## Affected products

- MongoDB MongoDB before 7.0.41, 8.0.x before 8.0.30, 8.1.x before 8.2.13, 8.2.x before 8.2.13, 8.3.x before 8.3.9, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later

## References

- [https://jira.mongodb.org/browse/SERVER-132650](https://jira.mongodb.org/browse/SERVER-132650)

## Related threats

- [MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim)
- [MongoDB privilege escalation via change stream showSystemEvents](https://junglewise.ai/threats/cve-2026-120816-a-user-with-basic-read-tier-database-privileges-can-use-an)
- [MongoDB macOS TLS certificate validation bypass for IPv6](https://junglewise.ai/threats/cve-2026-120808-an-issue-exists-in-mongodb-s-macos-tls-client-implementation)
- [MongoDB resource leak in SSPI Kerberos authentication handler](https://junglewise.ai/threats/cve-2026-120804-a-flaw-exists-in-the-server-side-sspi-kerberos-authentication)
- [MongoDB use-after-free in SBE window function accumulator](https://junglewise.ai/threats/cve-2026-120803-a-use-after-free-issue-exists-in-mongodb-s-sbe-slot-based)