CVE-2026-82065
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-617
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- MongoDB MongoDB Server
- MongoDB MongoDB Server
- MongoDB MongoDB Server
Weakness type
Related vulnerabilities
- CVE-2026-82068 — Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
- CVE-2026-82064 — Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
- CVE-2026-82059 — Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
- CVE-2026-82052 — $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
- CVE-2026-86317 — ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
- CVE-2026-20504 — In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote...
- CVE-2026-20503 — In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote...
- CVE-2026-31911 — abort() in libpcap before 1.10.7 on an invalid BPF opcode