CVE-2026-82068
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CWE
- CWE-617
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- MongoDB MongoDB Server
- MongoDB MongoDB Server
- MongoDB MongoDB Server
Weakness type
Related vulnerabilities
- CVE-2026-82065 — Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
- CVE-2026-82064 — Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
- CVE-2026-82059 — Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
- CVE-2026-82052 — $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
- CVE-2026-86317 — ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
- CVE-2026-20504 — In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote...
- CVE-2026-20503 — In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote...
- CVE-2026-31911 — abort() in libpcap before 1.10.7 on an invalid BPF opcode