PT-2026-40528 · Mongodb · Mongodb Server+1

CVE-2026-8199 · Published 2026-05-13 · Updated 2026-05-14

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.34 MongoDB Server versions prior to 8.0.23 MongoDB Server versions prior to 8.2.9 MongoDB Server versions prior to 8.3.2

Description An authenticated user can cause excessive memory usage during the processing of bitwise match expression Abstract Syntax Trees (AST). This occurs when using $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. Such memory pressure may lead to a loss of availability due to Out-of-Memory (OOM) conditions, where the system terminates processes because it has run out of available RAM.

Recommendations Update to version 7.0.34 or later. Update to version 8.0.23 or later. Update to version 8.2.9 or later. Update to version 8.3.2 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1325

Related Identifiers

BIT-MONGODB-2026-8199

CVE-2026-8199

Affected Products

Mongodb Server

Mongodb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8199.json · Exploit
• https://jira.mongodb.org/browse/SERVER-122449 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mongodb-2026-8199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-8199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8199 · Security Note
• https://ubuntu.com/security/CVE-2026-8199 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8199 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8199 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8199 · Note
• https://t.me/CVEtracker/53589 · Telegram Post