CVE-2026-82056

MediumCVSS 5.3/10Last modified Sep 16, 2026

Description

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820576.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By s CVE-2026-820586.5A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod CVE-2026-820596.5An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being re CVE-2026-82069.8The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeo CVE-2026-820605.4In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specia CVE-2026-820618.1A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges CVE-2026-820625.5A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the a CVE-2026-820635.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of servi CVE-2026-820647.5A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set mem CVE-2026-820656.5A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges t CVE-2026-820668.1A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read CVE-2026-820678.1Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to r