CVE-2026-18711: MongoDB Use-After-Free Vulnerability Leading to Denial of Service
Summary
CVE-2026-18711: An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running cert... Affects mongodb across 3 version ranges.
>= 7.0.0, < 7.0.41
>= 8.0.0, < 8.0.29
>= 8.2.0, < 8.3.8
Fixed in 7.0.41, 8.0.29 or 8.3.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MongoDB is a widely used open-source NoSQL database that provides high performance, high availability, and easy scalability. It is designed to handle large volumes of data and is particularly well-suited for applications that require flexible data models. However, like any software, MongoDB is not immune to vulnerabilities. The specific issue at hand involves a flaw in the query execution engine that can be exploited under certain conditions.
Vulnerability Detail
The vulnerability identified as CVE-2026-18711 arises from a use-after-free condition in MongoDB's query execution engine. This flaw allows an authenticated user with read and write privileges to execute specific queries against time-series collections, leading to the potential for a server crash or the disclosure of sensitive information from freed memory. The technical implications of this vulnerability are significant, as it can compromise the stability and security of the database server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.417.0.41 -
>= 8.0.0, < 8.0.298.0.29 -
>= 8.2.0, < 8.3.88.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider restricting access to the MongoDB instance to trusted users only, thereby minimizing the risk of exploitation until the patch can be applied.
Conclusion
The CVE-2026-18711 vulnerability in MongoDB poses significant risks, including potential denial of service and memory disclosure. It is crucial for users to update to the patched versions to mitigate these risks. Additionally, employing workarounds can provide temporary relief while updates are being implemented.
See every vulnerability recorded for mongodb →
FAQ
CVE-2026-18711 is a vulnerability in MongoDB's query execution engine that can lead to denial of service and potential memory disclosure.
Any authenticated user with read and write privileges on MongoDB time-series collections may exploit this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability can lead to server crashes and potential exposure of sensitive data from freed memory.
As a workaround, restrict access to the MongoDB instance to trusted users only until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongodb.
