MongoDB 8.x — End of Life
Active Actively exploited EOL: Oct 31, 2029in 1104d4 releases in this series118 CVEs
MongoDB 8.x is partially supported: only 8.3, 8.0 still receive security fixes, the longest-lived (8.3) until Oct 31, 2029, in 1104 days. The most recent release in this series is 8.3.13. 118 CVEs are tracked for this series, including 1 actively exploited according to CISA KEV. 28 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is MongoDB 9. See MongoDB 9 →
MongoDB 8.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 8.3 | May 31, 2026 | — | Oct 31, 2029 | 8.3.13 | Active | |
| 8.2 | Sep 30, 2025 | — | Jul 31, 2026 | 8.2.12 | EOL | |
| 8.1 | Jun 30, 2025 | — | Sep 30, 2025 | 8.1.3 | EOL | |
| 8.0 | Oct 31, 2024 | — | Oct 31, 2029 | 8.0.34 | Active |
CVEs affecting MongoDB 8.x (280)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89099 | HIGH | 7.5 | 0.32% | — | 8.0 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam… | Sep 11, 2026 |
| CVE-2026-89099 | HIGH | 7.5 | 0.32% | — | 8.3 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam… | Sep 11, 2026 |
| CVE-2026-82076 | MEDIUM | 6.5 | 0.41% | — | 8.0 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary data… | Sep 8, 2026 |
| CVE-2026-82076 | MEDIUM | 6.5 | 0.41% | — | 8.2 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary data… | Sep 8, 2026 |
| CVE-2026-82076 | MEDIUM | 6.5 | 0.41% | — | 8.3 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary data… | Sep 8, 2026 |
| CVE-2026-82075 | HIGH | 7.5 | 0.51% | — | 8.0 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router … | Sep 8, 2026 |
| CVE-2026-82075 | HIGH | 7.5 | 0.51% | — | 8.3 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router … | Sep 8, 2026 |
| CVE-2026-82074 | MEDIUM | 6.5 | 0.35% | — | 8.0 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user wit… | Sep 8, 2026 |
| CVE-2026-82073 | MEDIUM | 6.5 | 0.36% | — | 8.3 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges t… | Sep 8, 2026 |
| CVE-2026-82071 | HIGH | 8.1 | 0.54% | — | 8.3 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with writ… | Sep 8, 2026 |
| CVE-2026-82070 | MEDIUM | 6.5 | 0.32% | — | 8.2 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privile… | Sep 8, 2026 |
| CVE-2026-82070 | MEDIUM | 6.5 | 0.32% | — | 8.3 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privile… | Sep 8, 2026 |
| CVE-2026-82070 | MEDIUM | 6.5 | 0.32% | — | 8.0 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privile… | Sep 8, 2026 |
| CVE-2026-82069 | LOW | 2.7 | 0.41% | — | 8.3 | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privilege… | Sep 8, 2026 |
| CVE-2026-82068 | MEDIUM | 6.5 | 0.40% | — | 8.3 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal asse… | Sep 8, 2026 |
| CVE-2026-82068 | MEDIUM | 6.5 | 0.40% | — | 8.0 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal asse… | Sep 8, 2026 |
| CVE-2026-82067 | HIGH | 8.1 | 0.50% | — | 8.3 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authoriz… | Sep 8, 2026 |
| CVE-2026-82067 | HIGH | 8.1 | 0.50% | — | 8.0 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authoriz… | Sep 8, 2026 |
| CVE-2026-82066 | MEDIUM | 4.3 | 0.38% | — | 8.3 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user… | Sep 8, 2026 |
| CVE-2026-82066 | MEDIUM | 4.3 | 0.38% | — | 8.0 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user… | Sep 8, 2026 |
| CVE-2026-82065 | MEDIUM | 6.5 | 0.40% | — | 8.3 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection c… | Sep 8, 2026 |
| CVE-2026-82065 | MEDIUM | 6.5 | 0.40% | — | 8.0 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection c… | Sep 8, 2026 |
| CVE-2026-82064 | HIGH | 7.5 | 0.51% | — | 8.0 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific typ… | Sep 8, 2026 |
| CVE-2026-82064 | HIGH | 7.5 | 0.51% | — | 8.3 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific typ… | Sep 8, 2026 |
| CVE-2026-82063 | MEDIUM | 5.3 | 0.36% | — | 8.3 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cau… | Sep 8, 2026 |
| CVE-2026-82063 | MEDIUM | 5.3 | 0.36% | — | 8.0 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cau… | Sep 8, 2026 |
| CVE-2026-82062 | MEDIUM | 5.5 | 0.45% | — | 8.3 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled f… | Sep 8, 2026 |
| CVE-2026-82061 | HIGH | 8.1 | 0.52% | — | 8.3 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user … | Sep 8, 2026 |
| CVE-2026-82060 | MEDIUM | 5.4 | 0.31% | — | 8.3 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store d… | Sep 8, 2026 |
| CVE-2026-82060 | MEDIUM | 5.4 | 0.31% | — | 8.0 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store d… | Sep 8, 2026 |
| CVE-2026-82059 | MEDIUM | 5.3 | 0.36% | — | 8.0 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user … | Sep 8, 2026 |
| CVE-2026-82059 | MEDIUM | 5.3 | 0.36% | — | 8.3 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user … | Sep 8, 2026 |
| CVE-2026-82058 | MEDIUM | 6.5 | 0.40% | — | 8.3 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges … | Sep 8, 2026 |
| CVE-2026-82058 | MEDIUM | 6.5 | 0.40% | — | 8.0 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges … | Sep 8, 2026 |
| CVE-2026-82057 | MEDIUM | 6.5 | 0.42% | — | 8.3 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod … | Sep 8, 2026 |
| CVE-2026-82056 | MEDIUM | 5.3 | 0.33% | — | 8.3 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert … | Sep 8, 2026 |
| CVE-2026-82056 | MEDIUM | 5.3 | 0.33% | — | 8.0 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert … | Sep 8, 2026 |
| CVE-2026-82055 | MEDIUM | 6.5 | 0.40% | — | 8.3 | A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer d… | Sep 8, 2026 |
| CVE-2026-82054 | MEDIUM | 6.5 | 0.40% | — | 8.2 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a … | Sep 8, 2026 |
| CVE-2026-82054 | MEDIUM | 6.5 | 0.40% | — | 8.3 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a … | Sep 8, 2026 |
| CVE-2026-82054 | MEDIUM | 6.5 | 0.40% | — | 8.0 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a … | Sep 8, 2026 |
| CVE-2026-82053 | HIGH | 8.1 | 0.41% | — | 8.0 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authe… | Sep 8, 2026 |
| CVE-2026-82053 | HIGH | 8.1 | 0.41% | — | 8.3 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authe… | Sep 8, 2026 |
| CVE-2026-82053 | HIGH | 8.1 | 0.41% | — | 8.2 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authe… | Sep 8, 2026 |
| CVE-2026-82052 | MEDIUM | 6.5 | 0.49% | — | 8.3 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a Mon… | Sep 8, 2026 |
| CVE-2026-82052 | MEDIUM | 6.5 | 0.49% | — | 8.0 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a Mon… | Sep 8, 2026 |
| CVE-2026-18712 | HIGH | 8.1 | 0.17% | — | 8.0 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileg… | Aug 11, 2026 |
| CVE-2026-18712 | HIGH | 8.1 | 0.17% | — | 8.2 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileg… | Aug 11, 2026 |
| CVE-2026-18712 | HIGH | 8.1 | 0.17% | — | 8.3 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileg… | Aug 11, 2026 |
| CVE-2026-18711 | HIGH | 7.1 | 0.49% | — | 8.2 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to … | Aug 11, 2026 |
| CVE-2026-18711 | HIGH | 7.1 | 0.49% | — | 8.0 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to … | Aug 11, 2026 |
| CVE-2026-18711 | HIGH | 7.1 | 0.49% | — | 8.3 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to … | Aug 11, 2026 |
| CVE-2026-18709 | MEDIUM | 6.4 | 0.19% | — | 8.3 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit … | Aug 11, 2026 |
| CVE-2026-18709 | MEDIUM | 6.4 | 0.19% | — | 8.2 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit … | Aug 11, 2026 |
| CVE-2026-18709 | MEDIUM | 6.4 | 0.19% | — | 8.0 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit … | Aug 11, 2026 |
| CVE-2026-18708 | MEDIUM | 6.4 | 0.38% | — | 8.3 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18708 | MEDIUM | 6.4 | 0.38% | — | 8.0 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18708 | MEDIUM | 6.4 | 0.38% | — | 8.2 | An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18707 | MEDIUM | 4.3 | 0.25% | — | 8.0 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the se… | Aug 11, 2026 |
| CVE-2026-18707 | MEDIUM | 4.3 | 0.25% | — | 8.3 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the se… | Aug 11, 2026 |
| CVE-2026-18707 | MEDIUM | 4.3 | 0.25% | — | 8.2 | An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the se… | Aug 11, 2026 |
| CVE-2026-18706 | MEDIUM | 6.6 | 0.46% | — | 8.3 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation … | Aug 11, 2026 |
| CVE-2026-18705 | MEDIUM | 6.5 | 0.36% | — | 8.3 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view … | Aug 11, 2026 |
| CVE-2026-18705 | MEDIUM | 6.5 | 0.36% | — | 8.2 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view … | Aug 11, 2026 |
| CVE-2026-18705 | MEDIUM | 6.5 | 0.36% | — | 8.0 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view … | Aug 11, 2026 |
| CVE-2026-18704 | MEDIUM | 6.5 | 0.20% | — | 8.3 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perfor… | Aug 11, 2026 |
| CVE-2026-18703 | MEDIUM | 4.2 | 0.14% | — | 8.3 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authe… | Aug 11, 2026 |
| CVE-2026-18703 | MEDIUM | 4.2 | 0.14% | — | 8.2 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authe… | Aug 11, 2026 |
| CVE-2026-18702 | MEDIUM | 6.4 | 0.27% | — | 8.2 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnost… | Aug 11, 2026 |
| CVE-2026-18702 | MEDIUM | 6.4 | 0.27% | — | 8.3 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnost… | Aug 11, 2026 |
| CVE-2026-18702 | MEDIUM | 6.4 | 0.27% | — | 8.0 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnost… | Aug 11, 2026 |
| CVE-2026-18701 | MEDIUM | 6.5 | 0.40% | — | 8.2 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server … | Aug 11, 2026 |
| CVE-2026-18701 | MEDIUM | 6.5 | 0.40% | — | 8.3 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server … | Aug 11, 2026 |
| CVE-2026-18701 | MEDIUM | 6.5 | 0.40% | — | 8.0 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server … | Aug 11, 2026 |
| CVE-2026-18700 | MEDIUM | 6.5 | 0.40% | — | 8.2 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an i… | Aug 11, 2026 |
| CVE-2026-18700 | MEDIUM | 6.5 | 0.40% | — | 8.3 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an i… | Aug 11, 2026 |
| CVE-2026-18700 | MEDIUM | 6.5 | 0.40% | — | 8.0 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an i… | Aug 11, 2026 |
| CVE-2026-18699 | MEDIUM | 6.5 | 0.40% | — | 8.2 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the ser… | Aug 11, 2026 |
| CVE-2026-18699 | MEDIUM | 6.5 | 0.40% | — | 8.3 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the ser… | Aug 11, 2026 |
| CVE-2026-18699 | MEDIUM | 6.5 | 0.40% | — | 8.0 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the ser… | Aug 11, 2026 |
| CVE-2026-18698 | MEDIUM | 5.4 | 0.24% | — | 8.2 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18698 | MEDIUM | 5.4 | 0.24% | — | 8.3 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18698 | MEDIUM | 5.4 | 0.24% | — | 8.0 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18697 | HIGH | 7.5 | 0.44% | — | 8.2 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce… | Aug 11, 2026 |
| CVE-2026-18697 | HIGH | 7.5 | 0.44% | — | 8.3 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce… | Aug 11, 2026 |
| CVE-2026-18697 | HIGH | 7.5 | 0.44% | — | 8.0 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) proce… | Aug 11, 2026 |
| CVE-2026-18696 | MEDIUM | 6.5 | 0.40% | — | 8.2 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to … | Aug 11, 2026 |
| CVE-2026-18696 | MEDIUM | 6.5 | 0.40% | — | 8.3 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to … | Aug 11, 2026 |
| CVE-2026-18696 | MEDIUM | 6.5 | 0.40% | — | 8.0 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to … | Aug 11, 2026 |
| CVE-2026-18695 | MEDIUM | 6.5 | 0.40% | — | 8.2 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could… | Aug 11, 2026 |
| CVE-2026-18695 | MEDIUM | 6.5 | 0.40% | — | 8.3 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could… | Aug 11, 2026 |
| CVE-2026-18695 | MEDIUM | 6.5 | 0.40% | — | 8.0 | An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could… | Aug 11, 2026 |
| CVE-2026-18694 | HIGH | 7.1 | 0.39% | — | 8.3 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18694 | HIGH | 7.1 | 0.39% | — | 8.2 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18694 | HIGH | 7.1 | 0.39% | — | 8.0 | An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to caus… | Aug 11, 2026 |
| CVE-2026-18693 | HIGH | 7.6 | 0.34% | — | 8.0 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges … | Aug 11, 2026 |
| CVE-2026-18693 | HIGH | 7.6 | 0.34% | — | 8.3 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges … | Aug 11, 2026 |
| CVE-2026-18693 | HIGH | 7.6 | 0.34% | — | 8.2 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges … | Aug 11, 2026 |
| CVE-2026-18692 | HIGH | 8.8 | 0.57% | — | 8.2 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privil… | Aug 11, 2026 |
| CVE-2026-18692 | HIGH | 8.8 | 0.57% | — | 8.3 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privil… | Aug 11, 2026 |
| CVE-2026-18692 | HIGH | 8.8 | 0.57% | — | 8.0 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privil… | Aug 11, 2026 |
| CVE-2026-18691 | HIGH | 8.8 | 0.35% | — | 8.2 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influenc… | Aug 11, 2026 |
| CVE-2026-18691 | HIGH | 8.8 | 0.35% | — | 8.3 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influenc… | Aug 11, 2026 |
| CVE-2026-18691 | HIGH | 8.8 | 0.35% | — | 8.0 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influenc… | Aug 11, 2026 |
| CVE-2026-18690 | HIGH | 8.1 | 0.40% | — | 8.2 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18690 | HIGH | 8.1 | 0.40% | — | 8.3 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18690 | HIGH | 8.1 | 0.40% | — | 8.0 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action ag… | Aug 11, 2026 |
| CVE-2026-18688 | HIGH | 7.1 | 0.39% | — | 8.2 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory … | Aug 11, 2026 |
| CVE-2026-18688 | HIGH | 7.1 | 0.39% | — | 8.3 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory … | Aug 11, 2026 |
| CVE-2026-18688 | HIGH | 7.1 | 0.39% | — | 8.0 | An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory … | Aug 11, 2026 |
| CVE-2026-18687 | HIGH | 7.1 | 0.23% | — | 8.2 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request para… | Aug 11, 2026 |
| CVE-2026-18687 | HIGH | 7.1 | 0.23% | — | 8.3 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request para… | Aug 11, 2026 |
| CVE-2026-18687 | HIGH | 7.1 | 0.23% | — | 8.0 | MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request para… | Aug 11, 2026 |
| CVE-2026-9737 | MEDIUM | 6.5 | 0.42% | — | 8.2 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the m… | Jul 22, 2026 |
| CVE-2026-9737 | MEDIUM | 6.5 | 0.42% | — | 8.0 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the m… | Jul 22, 2026 |
| CVE-2026-9737 | MEDIUM | 6.5 | 0.42% | — | 8.3 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the m… | Jul 22, 2026 |
| CVE-2026-13078 | HIGH | 7.7 | 0.34% | — | 8.2 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered… | Jul 22, 2026 |
| CVE-2026-13078 | HIGH | 7.7 | 0.34% | — | 8.3 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered… | Jul 22, 2026 |
| CVE-2026-13078 | HIGH | 7.7 | 0.34% | — | 8.0 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered… | Jul 22, 2026 |
| CVE-2026-13077 | HIGH | 7.1 | 0.42% | — | 8.0 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read… | Jul 22, 2026 |
| CVE-2026-13077 | HIGH | 7.1 | 0.42% | — | 8.3 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read… | Jul 22, 2026 |
| CVE-2026-13077 | HIGH | 7.1 | 0.42% | — | 8.2 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read… | Jul 22, 2026 |
| CVE-2026-13076 | MEDIUM | 6.5 | 0.42% | — | 8.3 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by p… | Jul 22, 2026 |
| CVE-2026-13075 | MEDIUM | 6.5 | 0.42% | — | 8.2 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via th… | Jul 22, 2026 |
| CVE-2026-13075 | MEDIUM | 6.5 | 0.42% | — | 8.3 | An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via th… | Jul 22, 2026 |
| CVE-2026-13074 | MEDIUM | 5.3 | 0.44% | — | 8.3 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combinati… | Jul 22, 2026 |
| CVE-2026-13074 | MEDIUM | 5.3 | 0.44% | — | 8.0 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combinati… | Jul 22, 2026 |
| CVE-2026-13074 | MEDIUM | 5.3 | 0.44% | — | 8.2 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combinati… | Jul 22, 2026 |
| CVE-2026-13073 | MEDIUM | 4.3 | 0.36% | — | 8.0 | An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafte… | Jul 22, 2026 |
| CVE-2026-13072 | HIGH | 8.1 | 0.40% | — | 8.0 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data du… | Jul 22, 2026 |
| CVE-2026-13072 | HIGH | 8.1 | 0.40% | — | 8.2 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data du… | Jul 22, 2026 |
| CVE-2026-13072 | HIGH | 8.1 | 0.40% | — | 8.3 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data du… | Jul 22, 2026 |
| CVE-2026-13071 | MEDIUM | 6.5 | 0.42% | — | 8.3 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation express… | Jul 22, 2026 |
| CVE-2026-13071 | MEDIUM | 6.5 | 0.42% | — | 8.0 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation express… | Jul 22, 2026 |
| CVE-2026-13071 | MEDIUM | 6.5 | 0.42% | — | 8.2 | An authenticated user with read access can cause the mongod process to be terminated through certain aggregation express… | Jul 22, 2026 |
| CVE-2026-13070 | MEDIUM | 5.3 | 0.13% | — | 8.3 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP respons… | Jul 22, 2026 |
| CVE-2026-13070 | MEDIUM | 5.3 | 0.13% | — | 8.2 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP respons… | Jul 22, 2026 |
| CVE-2026-13070 | MEDIUM | 5.3 | 0.13% | — | 8.0 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP respons… | Jul 22, 2026 |
| CVE-2026-13069 | MEDIUM | 6.5 | 0.29% | — | 8.2 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a c… | Jul 22, 2026 |
| CVE-2026-13069 | MEDIUM | 6.5 | 0.29% | — | 8.3 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a c… | Jul 22, 2026 |
| CVE-2026-13069 | MEDIUM | 6.5 | 0.29% | — | 8.0 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a c… | Jul 22, 2026 |
| CVE-2026-13068 | MEDIUM | 4.2 | 0.25% | — | 8.2 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate ac… | Jul 22, 2026 |
| CVE-2026-13068 | MEDIUM | 4.2 | 0.25% | — | 8.3 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate ac… | Jul 22, 2026 |
| CVE-2026-13068 | MEDIUM | 4.2 | 0.25% | — | 8.0 | An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate ac… | Jul 22, 2026 |
| CVE-2026-13067 | MEDIUM | 6.3 | 0.09% | — | 8.3 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be v… | Jul 22, 2026 |
| CVE-2026-13067 | MEDIUM | 6.3 | 0.09% | — | 8.0 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be v… | Jul 22, 2026 |
| CVE-2026-13066 | MEDIUM | 6.5 | 0.36% | — | 8.2 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result i… | Jul 22, 2026 |
| CVE-2026-13066 | MEDIUM | 6.5 | 0.36% | — | 8.3 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result i… | Jul 22, 2026 |
| CVE-2026-13066 | MEDIUM | 6.5 | 0.36% | — | 8.0 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result i… | Jul 22, 2026 |
| CVE-2026-13065 | MEDIUM | 6.5 | 0.49% | — | 8.2 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator… | Jul 22, 2026 |
| CVE-2026-13065 | MEDIUM | 6.5 | 0.49% | — | 8.3 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator… | Jul 22, 2026 |
| CVE-2026-13065 | MEDIUM | 6.5 | 0.49% | — | 8.0 | A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator… | Jul 22, 2026 |
| CVE-2026-13064 | MEDIUM | 6.5 | 0.45% | — | 8.2 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in … | Jul 22, 2026 |
| CVE-2026-13064 | MEDIUM | 6.5 | 0.45% | — | 8.3 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in … | Jul 22, 2026 |
| CVE-2026-13064 | MEDIUM | 6.5 | 0.45% | — | 8.0 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in … | Jul 22, 2026 |
| CVE-2026-13063 | MEDIUM | 4.3 | 0.40% | — | 8.3 | An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-mem… | Jul 22, 2026 |
| CVE-2026-13063 | MEDIUM | 4.3 | 0.40% | — | 8.2 | An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-mem… | Jul 22, 2026 |
| CVE-2026-13062 | MEDIUM | 6.5 | 0.18% | — | 8.2 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal … | Jul 22, 2026 |
| CVE-2026-13062 | MEDIUM | 6.5 | 0.18% | — | 8.3 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal … | Jul 22, 2026 |
| CVE-2026-13062 | MEDIUM | 6.5 | 0.18% | — | 8.0 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal … | Jul 22, 2026 |
| CVE-2026-13061 | MEDIUM | 4.3 | 0.27% | — | 8.3 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessi… | Jul 22, 2026 |
| CVE-2026-13061 | MEDIUM | 4.3 | 0.27% | — | 8.0 | An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessi… | Jul 22, 2026 |
| CVE-2026-13060 | MEDIUM | 6.5 | 0.42% | — | 8.2 | An authenticated user with limited read privileges may be able to access documents from collections they are not authori… | Jul 22, 2026 |
| CVE-2026-13060 | MEDIUM | 6.5 | 0.42% | — | 8.3 | An authenticated user with limited read privileges may be able to access documents from collections they are not authori… | Jul 22, 2026 |
| CVE-2026-13060 | MEDIUM | 6.5 | 0.42% | — | 8.0 | An authenticated user with limited read privileges may be able to access documents from collections they are not authori… | Jul 22, 2026 |
| CVE-2026-13059 | HIGH | 8.1 | 0.38% | — | 8.3 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role… | Jul 22, 2026 |
| CVE-2026-13059 | HIGH | 8.1 | 0.38% | — | 8.2 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role… | Jul 22, 2026 |
| CVE-2026-13059 | HIGH | 8.1 | 0.38% | — | 8.0 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role… | Jul 22, 2026 |
| CVE-2026-13058 | MEDIUM | 6.5 | 0.40% | — | 8.0 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a craf… | Jul 22, 2026 |
| CVE-2026-13058 | MEDIUM | 6.5 | 0.40% | — | 8.3 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a craf… | Jul 22, 2026 |
| CVE-2026-13058 | MEDIUM | 6.5 | 0.40% | — | 8.2 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a craf… | Jul 22, 2026 |
| CVE-2026-13057 | MEDIUM | 5.3 | 0.34% | — | 8.2 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In… | Jul 22, 2026 |
| CVE-2026-13057 | MEDIUM | 5.3 | 0.34% | — | 8.3 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In… | Jul 22, 2026 |
| CVE-2026-13057 | MEDIUM | 5.3 | 0.34% | — | 8.0 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In… | Jul 22, 2026 |
| CVE-2026-13056 | MEDIUM | 6.5 | 0.40% | — | 8.3 | Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate object… | Jul 22, 2026 |
| CVE-2026-13056 | MEDIUM | 6.5 | 0.40% | — | 8.0 | Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate object… | Jul 22, 2026 |
| CVE-2026-13055 | MEDIUM | 6.5 | 0.40% | — | 8.2 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod)… | Jul 22, 2026 |
| CVE-2026-13055 | MEDIUM | 6.5 | 0.40% | — | 8.3 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod)… | Jul 22, 2026 |
| CVE-2026-13055 | MEDIUM | 6.5 | 0.40% | — | 8.0 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod)… | Jul 22, 2026 |
| CVE-2026-9754 | MEDIUM | 6.5 | 0.37% | — | 8.3 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is… | Jun 9, 2026 |
| CVE-2026-9754 | MEDIUM | 6.5 | 0.37% | — | 8.2 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is… | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 8.2 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 8.3 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9753 | HIGH | 8.1 | 0.52% | — | 8.0 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed … | Jun 9, 2026 |
| CVE-2026-9752 | MEDIUM | 6.5 | 0.47% | — | 8.3 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO… | Jun 9, 2026 |
| CVE-2026-9752 | MEDIUM | 6.5 | 0.47% | — | 8.2 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO… | Jun 9, 2026 |
| CVE-2026-9752 | MEDIUM | 6.5 | 0.47% | — | 8.0 | An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO… | Jun 9, 2026 |
| CVE-2026-9751 | MEDIUM | 5.5 | 0.15% | — | 8.2 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon… | Jun 9, 2026 |
| CVE-2026-9751 | MEDIUM | 5.5 | 0.15% | — | 8.3 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon… | Jun 9, 2026 |
| CVE-2026-9751 | MEDIUM | 5.5 | 0.15% | — | 8.0 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon… | Jun 9, 2026 |
| CVE-2026-9750 | MEDIUM | 6.5 | 0.56% | — | 8.2 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe… | Jun 9, 2026 |
| CVE-2026-9750 | MEDIUM | 6.5 | 0.56% | — | 8.0 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe… | Jun 9, 2026 |
| CVE-2026-9750 | MEDIUM | 6.5 | 0.56% | — | 8.3 | An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe… | Jun 9, 2026 |
| CVE-2026-9749 | MEDIUM | 6.5 | 0.47% | — | 8.0 | This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran… | Jun 9, 2026 |
| CVE-2026-9749 | MEDIUM | 6.5 | 0.47% | — | 8.3 | This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran… | Jun 9, 2026 |
| CVE-2026-9749 | MEDIUM | 6.5 | 0.47% | — | 8.2 | This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran… | Jun 9, 2026 |
| CVE-2026-9748 | MEDIUM | 6.5 | 0.56% | — | 8.0 | The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st… | Jun 9, 2026 |
| CVE-2026-9748 | MEDIUM | 6.5 | 0.56% | — | 8.3 | The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st… | Jun 9, 2026 |
| CVE-2026-9748 | MEDIUM | 6.5 | 0.56% | — | 8.2 | The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st… | Jun 9, 2026 |
| CVE-2026-9747 | MEDIUM | 6.5 | 0.47% | — | 8.3 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | Jun 9, 2026 |
| CVE-2026-9747 | MEDIUM | 6.5 | 0.47% | — | 8.0 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | Jun 9, 2026 |
| CVE-2026-9747 | MEDIUM | 6.5 | 0.47% | — | 8.2 | Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. | Jun 9, 2026 |
| CVE-2026-9746 | MEDIUM | 6.5 | 0.47% | — | 8.0 | When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which… | Jun 9, 2026 |
| CVE-2026-9746 | MEDIUM | 6.5 | 0.47% | — | 8.3 | When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which… | Jun 9, 2026 |
| CVE-2026-9746 | MEDIUM | 6.5 | 0.47% | — | 8.2 | When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which… | Jun 9, 2026 |
| CVE-2026-9743 | MEDIUM | 6.5 | 0.47% | — | 8.0 | In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines… | Jun 9, 2026 |
| CVE-2026-9742 | HIGH | 7.5 | 0.50% | — | 8.3 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of th… | Jun 9, 2026 |
| CVE-2026-9742 | HIGH | 7.5 | 0.50% | — | 8.2 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of th… | Jun 9, 2026 |
| CVE-2026-9741 | MEDIUM | 6.5 | 0.15% | — | 8.3 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F… | Jun 9, 2026 |
| CVE-2026-9741 | MEDIUM | 6.5 | 0.15% | — | 8.0 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F… | Jun 9, 2026 |
| CVE-2026-9741 | MEDIUM | 6.5 | 0.15% | — | 8.2 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F… | Jun 9, 2026 |
| CVE-2026-9740 | HIGH | 7.5 | 0.53% | — | 8.0 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by … | Jun 9, 2026 |
| CVE-2026-9740 | HIGH | 7.5 | 0.53% | — | 8.2 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by … | Jun 9, 2026 |
| CVE-2026-9740 | HIGH | 7.5 | 0.53% | — | 8.3 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by … | Jun 9, 2026 |
| CVE-2026-9735 | MEDIUM | 5.5 | 0.17% | — | 8.3 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. W… | Jun 9, 2026 |
| CVE-2026-8843 | MEDIUM | 6.5 | 0.42% | — | 8.0 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to ins… | May 18, 2026 |
| CVE-2026-8843 | MEDIUM | 6.5 | 0.42% | — | 8.2 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to ins… | May 18, 2026 |
| CVE-2026-8336 | HIGH | 7.5 | 0.47% | — | 8.2 | After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in… | May 13, 2026 |
| CVE-2026-8336 | HIGH | 7.5 | 0.47% | — | 8.3 | After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in… | May 13, 2026 |
| CVE-2026-8202 | MEDIUM | 4.3 | 0.45% | — | 8.0 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $r… | May 13, 2026 |
| CVE-2026-8202 | MEDIUM | 4.3 | 0.45% | — | 8.3 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $r… | May 13, 2026 |
| CVE-2026-8202 | MEDIUM | 4.3 | 0.45% | — | 8.2 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $r… | May 13, 2026 |
| CVE-2026-8201 | MEDIUM | 6.4 | 0.21% | — | 8.0 | A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting clie… | May 13, 2026 |
| CVE-2026-8201 | MEDIUM | 6.4 | 0.21% | — | 8.3 | A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting clie… | May 13, 2026 |
| CVE-2026-8201 | MEDIUM | 6.4 | 0.21% | — | 8.2 | A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting clie… | May 13, 2026 |
| CVE-2026-8200 | LOW | 2.7 | 0.34% | — | 8.3 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc… | May 13, 2026 |
| CVE-2026-8200 | LOW | 2.7 | 0.34% | — | 8.0 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc… | May 13, 2026 |
| CVE-2026-8200 | LOW | 2.7 | 0.34% | — | 8.2 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the loc… | May 13, 2026 |
| CVE-2026-8199 | MEDIUM | 6.5 | 0.45% | — | 8.0 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAny… | May 13, 2026 |
| CVE-2026-8199 | MEDIUM | 6.5 | 0.45% | — | 8.2 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAny… | May 13, 2026 |
| CVE-2026-8199 | MEDIUM | 6.5 | 0.45% | — | 8.3 | An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAny… | May 13, 2026 |
| CVE-2026-8053 | HIGH | 8.8 | 0.65% | — | 8.0 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv… | May 13, 2026 |
| CVE-2026-8053 | HIGH | 8.8 | 0.65% | — | 8.3 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv… | May 13, 2026 |
| CVE-2026-8053 | HIGH | 8.8 | 0.65% | — | 8.2 | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write priv… | May 13, 2026 |
| CVE-2026-8063 | MEDIUM | 6.5 | 0.39% | — | 8.2 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When … | May 7, 2026 |
| CVE-2026-6915 | MEDIUM | 6.3 | 0.28% | — | 8.0 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authen… | Apr 29, 2026 |
| CVE-2026-6915 | MEDIUM | 6.3 | 0.28% | — | 8.2 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authen… | Apr 29, 2026 |
| CVE-2026-6914 | MEDIUM | 6.5 | 0.44% | — | 8.1 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoD… | Apr 29, 2026 |
| CVE-2026-6914 | MEDIUM | 6.5 | 0.44% | — | 8.0 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoD… | Apr 29, 2026 |
| CVE-2026-6914 | MEDIUM | 6.5 | 0.44% | — | 8.2 | Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoD… | Apr 29, 2026 |
| CVE-2026-5170 | MEDIUM | 5.3 | 0.33% | — | 8.0 | A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during… | Mar 30, 2026 |
| CVE-2026-5170 | MEDIUM | 5.3 | 0.33% | — | 8.2 | A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during… | Mar 30, 2026 |
| CVE-2026-4358 | MEDIUM | 6.4 | 0.37% | — | 8.0 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-fre… | Mar 17, 2026 |
| CVE-2026-4358 | MEDIUM | 6.4 | 0.37% | — | 8.2 | A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-fre… | Mar 17, 2026 |
| CVE-2026-4148 | HIGH | 8.8 | 0.57% | — | 8.3 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issu… | Mar 17, 2026 |
| CVE-2026-4148 | HIGH | 8.8 | 0.57% | — | 8.0 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issu… | Mar 17, 2026 |
| CVE-2026-4148 | HIGH | 8.8 | 0.57% | — | 8.2 | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issu… | Mar 17, 2026 |
| CVE-2026-4147 | MEDIUM | 6.5 | 0.37% | — | 8.3 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is… | Mar 17, 2026 |
| CVE-2026-4147 | MEDIUM | 6.5 | 0.37% | — | 8.0 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is… | Mar 17, 2026 |
| CVE-2026-4147 | MEDIUM | 6.5 | 0.37% | — | 8.2 | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is… | Mar 17, 2026 |
| CVE-2026-25613 | MEDIUM | 6.5 | 0.48% | — | 8.0 | An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compo… | Feb 10, 2026 |
| CVE-2026-25613 | MEDIUM | 6.5 | 0.48% | — | 8.2 | An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compo… | Feb 10, 2026 |
| CVE-2026-25610 | MEDIUM | 6.5 | 0.48% | — | 8.0 | An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | Feb 10, 2026 |
| CVE-2026-25609 | MEDIUM | 5.4 | 0.33% | — | 8.0 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read… | Feb 10, 2026 |
| CVE-2026-25609 | MEDIUM | 5.4 | 0.33% | — | 8.2 | Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read… | Feb 10, 2026 |
| CVE-2026-1850 | MEDIUM | 6.5 | 0.28% | — | 8.0 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. | Feb 10, 2026 |
| CVE-2026-1850 | MEDIUM | 6.5 | 0.28% | — | 8.2 | Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. | Feb 10, 2026 |
| CVE-2026-1849 | MEDIUM | 6.5 | 0.31% | — | 8.2 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents… | Feb 10, 2026 |
| CVE-2026-1849 | MEDIUM | 6.5 | 0.31% | — | 8.0 | MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents… | Feb 10, 2026 |
| CVE-2026-1848 | HIGH | 7.5 | 0.30% | — | 8.0 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes i… | Feb 10, 2026 |
| CVE-2026-1848 | HIGH | 7.5 | 0.30% | — | 8.2 | Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes i… | Feb 10, 2026 |
| CVE-2026-1847 | MEDIUM | 6.5 | 0.28% | — | 8.0 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the o… | Feb 10, 2026 |
| CVE-2026-1847 | MEDIUM | 6.5 | 0.28% | — | 8.2 | Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the o… | Feb 10, 2026 |
| CVE-2025-14847 | HIGH | 7.5 | 83.21% | KEV | 8.2 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe… | Dec 19, 2025 |
| CVE-2025-14847 | HIGH | 7.5 | 83.21% | KEV | 8.0 | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthe… | Dec 19, 2025 |
| CVE-2025-14345 | MEDIUM | 4.2 | 0.21% | — | 8.2 | A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server … | Dec 9, 2025 |
| CVE-2025-14345 | MEDIUM | 4.2 | 0.21% | — | 8.0 | A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server … | Dec 9, 2025 |
| CVE-2025-14345 | MEDIUM | 4.2 | 0.21% | — | 8.3 | A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server … | Dec 9, 2025 |
| CVE-2025-13644 | MEDIUM | 6.5 | — | — | 8.1 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue a… | Nov 25, 2025 |
| CVE-2025-13644 | MEDIUM | 6.5 | — | — | 8.2 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue a… | Nov 25, 2025 |
| CVE-2025-13644 | MEDIUM | 6.5 | — | — | 8.0 | MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue a… | Nov 25, 2025 |
| CVE-2025-13643 | LOW | 3.1 | — | — | 8.2 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are bein… | Nov 25, 2025 |
| CVE-2025-13643 | LOW | 3.1 | — | — | 8.0 | A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are bein… | Nov 25, 2025 |
| CVE-2025-13507 | MEDIUM | 6.5 | — | — | 8.2 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON doc… | Nov 25, 2025 |
| CVE-2025-13507 | MEDIUM | 6.5 | — | — | 8.0 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON doc… | Nov 25, 2025 |
| CVE-2025-12893 | MEDIUM | 4.2 | — | — | 8.2 | Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not align… | Nov 25, 2025 |
| CVE-2025-12893 | MEDIUM | 4.2 | — | — | 8.0 | Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not align… | Nov 25, 2025 |
| CVE-2025-12657 | MEDIUM | 5.0 | — | — | 8.0 | The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them i… | Nov 3, 2025 |
| CVE-2025-11979 | MEDIUM | 5.3 | 0.26% | — | 8.0 | An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation… | Oct 20, 2025 |
| CVE-2025-10060 | MEDIUM | 6.5 | 0.37% | — | 8.0 | MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially… | Sep 5, 2025 |
MongoDB 8.x will reach end of life — migrate to MongoDB 9.x
MongoDB 9.x is the next major release. Plan your upgrade before MongoDB 8.x stops receiving security patches.
Add a MongoDB 8 EOL badge to your README
Show your users which MongoDB version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/mongodb/8)Frequently asked questions
Is MongoDB 8 end of life?
Partially. 2 of the 4 MongoDB 8.x releases have reached end of life. Still supported: 8.3, 8.0 (until October 31, 2029 at the latest).
What CVEs affect MongoDB 8?
There are 118 CVEs tracked for MongoDB 8.x and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest MongoDB 8 version?
The latest MongoDB 8.x patch release is 8.3.13, released on October 13, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from MongoDB 8 to MongoDB 9?
To migrate from MongoDB 8 to MongoDB 9: (1) review the official MongoDB 9 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run MongoDB 8 in production?
Only on a supported release (8.3, 8.0). Support for MongoDB 8.3 ends on October 31, 2029. Make sure you run the latest patch (8.3.13) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA