CVE-2026-8843highCWE-617

CVE-2026-8843: fallo de gravedad alta en MongoDB Server

Calling createIndex with certain index types can crash mongod

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear MongoDB Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.2%
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB, Inc. · MongoDB Server
CVEs relacionadas — MongoDB Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-8053HIGHFlatBSON Duplicate Field Index DriftEPSS 0.7%CVE-2026-8202MEDIUMPost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsEPSS 0.3%CVE-2026-8199HIGHPost-auth memory exhaustion via bitwise match expressionsEPSS 0.3%CVE-2026-8336HIGHPost-authentication use-after-free error in $_internalJsEmit and mapreduce commandsEPSS 0.3%CVE-2026-8200MEDIUMSchema validation log messages may not redact user dataEPSS 0.2%CVE-2026-8201MEDIUMUse-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted FieldsEPSS 0.1%