CVE-2026-8201mediumCWE-416

CVE-2026-8201: falha de média gravidade em MongoDB Server

Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

Publicada em

Seguir esta CVE+ Monitorar MongoDB Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.1%
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N
Produtos afetados
MongoDB, Inc. · MongoDB Server
CVEs relacionadas — MongoDB Server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-8053HIGHFlatBSON Duplicate Field Index DriftEPSS 0.7%CVE-2026-8202MEDIUMPost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsEPSS 0.3%CVE-2026-8199HIGHPost-auth memory exhaustion via bitwise match expressionsEPSS 0.3%CVE-2026-8336HIGHPost-authentication use-after-free error in $_internalJsEmit and mapreduce commandsEPSS 0.3%CVE-2026-8843HIGHCalling createIndex with certain index types can crash mongodEPSS 0.2%CVE-2026-8200MEDIUMSchema validation log messages may not redact user dataEPSS 0.2%