CVE-2026-82057

Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

State
Published
Severity
7.1 High
Published
Sep 8, 2026
Updated
Sep 8, 2026
Reserved
Aug 27, 2026

Read the record on cve.org

Description

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Nmongodb
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hmongodb

Weaknesses

  • CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Affected Products

ProductVersions
MongoDB ServerMongoDB
  • 8.3.0 to before 8.3.9Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.