MongoDB has released a security update that addresses several vulnerabilities in MongoDB Server.
The affected products include several versions of MongoDB Server, such as versions 4.4.0 through 4.4.31, 5.0.0 through 5.0.34, 6.0.0 through 6.0.29, 7.0.0 or higher but less than 7.0.48, 8.0.0 or higher but less than 8.0.37, 8.3.0 or higher but less than 8.3.16, and 9.0.0 or higher but less than 9.0.7.
The resolved vulnerabilities include CVE-2026-118383, a pre-authentication use-after-free vulnerability (a vulnerability where memory that has already been deallocated is reused). – Additionally, CVE-2026-120803, CVE-2026-120818, CVE-2026-120821, and CVE-2026-120824—all use-after-free vulnerabilities—as well as CVE-2026-120804 (failure to deallocate memory), incomplete cleanup in CVE-2026-120806, and insufficient checking for abnormal or exceptional conditions in CVE-2026-120807.
CVE-2026-120808 relates to improper certificate validation, while CVE-2026-120810 and CVE-2026-120828 are related to denial-of-service (DoS) attacks caused by unrestricted resource allocation.
CVE-2026-120813 involves an issue where encrypted fields may be stored in plain text; CVE-2026-120814 relates to code executing with unnecessary privileges, while CVE-2026-120815, CVE-2026-120822, and CVE-2026-120825, CVE-2026-120826 are related to permission checking errors. – CVE-2026-120817 is a race condition (an issue where errors occur depending on the execution order), and CVE-2026-120807, CVE-2026-120815, CVE-2026-120822, CVE-2026-120825, and CVE-2026-120826 involve the risk of unauthorized access due to authentication and authorization control failures.
MongoDB recommended updating to the latest version with the Vulnerability Patches to address these vulnerabilities, as outlined in the advisory. – After applying the patches, affected versions include, for example, 4.4.32 or later, 5.0.35 or later, 6.0.30 or higher, 7.0.48 or higher, 8.0.37 or higher, 8.3.16 or higher, and 9.0.7 or higher have been identified as versions that address these vulnerabilities.
