CVE-2026-120828
Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.
| CWE | CWE-770 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb mongodb server
Be the first to know when new high vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
MongoDB / MongoDB Server
9.0.0 < 9.0.7 8.3.0 < 8.3.16 8.0.0 < 8.0.37 7.0.0 < 7.0.48 6.0.0 < 6.0.30 5.0.0 < 5.0.35 4.4.0 < 4.4.32