MongoDB has released fixes for a critical vulnerability in its server software that lets an unauthenticated attacker crash a database member with just two requests - provided that member later takes over as primary while still behind on replication. The company rated the flaw, tracked as CVE-2026-118383, 9.5 out of 10 on the CVSS 4.0 scale and said it found the issue itself, adding it was "not aware of any attempts to take advantage of this vulnerability."

Researchers at Datadog Security Labs reproduced the crash in a lab and published their findings yesterday. The bug is a use-after-free: the server ends up using memory it has already freed. The two requests are ping commands carrying a readConcern.afterOpTime value, which plant pending notifications called waiters on the server. Those waiters do not expire and do not crash anything on their own.

The crash requires the targeted member to win a later election despite lagging behind another member. When its catch-up step ends, cleanup runs twice and reuses freed memory, and the new primary crashes before accepting any writes. Turning on authentication does not block the requests on vulnerable versions, and an attacker cannot force the member to fall behind or win an election, the researchers said.

Affected members include replica set members and the shard and config server members of sharded clusters. A standalone mongod outside any replica set is not affected, and every earlier release in each affected branch is vulnerable back to the branch's first release. MongoDB Atlas clusters receive fixed versions automatically during maintenance, and customers who defer maintenance should upgrade as soon as possible. Self-managed deployments need the fixed release on every replica set member.

The 8.2 branch is not on the affected list, but a GitHub proof of concept reports that 8.2.12 still showed the bug in a lab test using a test-only setting. That branch reached end of life on July 31. Until a member can be upgraded, the researchers advise restricting network access to only the systems that need it - which limits who can send the requests but does not fix the flaw. MongoDB says the flaw may also allow arbitrary code execution under certain conditions, though the researchers said they did not achieve code execution in the lab.

Source: The Hackers News