CVE-2026-81517

HighCVSS 7.5/10Last modified Sep 29, 2026

Description

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-815187.5When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake b CVE-2026-81529.3Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spa CVE-2026-815207.5A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by be CVE-2026-815216.5The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator charact CVE-2026-815228.1A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identif CVE-2026-815234.4A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier CVE-2026-815245.4A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without saniti CVE-2026-815258.1The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before usin CVE-2026-815266.5The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it CVE-2026-815276.5A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregatio CVE-2026-815285.4A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value CVE-2026-815297.1Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an ap