CVE-2026-118383: Use-after-free vulnerability in MongoDB
Read original article ↗AI Summary
CVE-2026-118383 is a critical use-after-free vulnerability in MongoDB Server's primary catch-up process, with a CVSS v4.0 score of 9.5. It affects replica set members, including those in sharded clusters, but not standalone instances. An unauthenticated remote attacker can trigger a denial-of-service condition by sending two ping requests with a readConcern.afterOpTime parameter before an election, leading to a segmentation fault when the member becomes primary and completes catch-up. While arbitrary code execution is theoretically possible under certain conditions, it was not demonstrated in testing. The vulnerability can be mitigated by upgrading to a fixed MongoDB version or restricting network access to MongoDB instances.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.