Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields (MongoDB, Inc. MongoDB Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.13 % · percentile 3 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mongodb
- NVD status
- Analyzed
Description
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.1 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N | mongodb |
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H | mongodb |
| CVSS 4.0 | MEDIUM 6.1 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-29892
- GCVE · GCVE-0-2026-8201
CERT-FR advisories
- CERTFR-2026-AVI-0986 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0888 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.34cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.23cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 8.2.0 < 8.2.9cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.2
Affected products
| Product | Versions |
|---|---|
| MongoDB, Inc. · MongoDB Server | affected 7.0 < 7.0.34 ; affected 8.0 < 8.0.23 ; affected 8.2 < 8.2.9 ; affected 8.3 < 8.3.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |