CVE-2026-8199

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1325

Affected software

VendorProductVersions
MongoDB, Inc.MongoDB Server>= 7.0, < 7.0.34; >= 8.0, < 8.0.23; >= 8.2, < 8.2.9; >= 8.3, < 8.3.2

References

Timeline

Published
May 13, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-819907.8Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-819915.5Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverCVE-2026-819927.8Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of theCVE-2026-819935.5Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. An attacker coulCVE-2026-819946.3Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability thaCVE-2026-819959.1Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution iCVE-2026-819968.8Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker CVE-2026-819976.3Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could levCVE-2026-819987.8Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-819998.7Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalatiCVE-2026-82005.3When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log messagCVE-2026-820009.6Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalati
CVE-2026-8199: Medium severity, CVSS 6.5 | Vulnix